lokibot

General

Target
ae442bf7856a39e487b74862733b7ddc.exe
Size 469KB
Sample211102-js9mjacae9
SHA256 12c21ab50e08cf3517c8c09be4597f0bc0dda3c6790dbc19e540f2d6f0272ae8
MD5 ae442bf7856a39e487b74862733b7ddc
SHA1 2b3dbc5e0318633d9cd7846f02c25677de366e05
SHA512 a8dc414732accec660289c11d60dfa6daff293af45771debd176f69d4ef0753b1830c4f12a54d24015c1d3975154c59fbb2e4988b1ac2fc01509fc5d7feb93a6
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://secure01-redirect.net/fd3/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  ae442bf7856a39e487b74862733b7ddc.exe
- Size 469KB
- SHA256 12c21ab50e08cf3517c8c09be4597f0bc0dda3c6790dbc19e540f2d6f0272ae8
- MD5 ae442bf7856a39e487b74862733b7ddc
- SHA1 2b3dbc5e0318633d9cd7846f02c25677de366e05
- SHA512 a8dc414732accec660289c11d60dfa6daff293af45771debd176f69d4ef0753b1830c4f12a54d24015c1d3975154c59fbb2e4988b1ac2fc01509fc5d7feb93a6
- MD5 SHA1 SHA512
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2