lokibot

General

Target
aeff2117dd63f1f66b4133b417044864.exe
Size 268KB
Sample211116-l2srgsdbg2
SHA256 c72f4bfca93a1d3c2b1b7ed37a9bbee747f12763a761838fde4a30a5c3969359
MD5 aeff2117dd63f1f66b4133b417044864
SHA1 b594a87d152c77c51ad677262bee32911db3f473
SHA512 451bced55d8fb3d92a8ab3294685468bb8fa57db334098fe6d4ad70449485c96bd4d3839c76d16831aacb5c25775ace5a185a176bcac0c09a6b90ef2177cf0c9
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://secure01-redirect.net/gb2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  aeff2117dd63f1f66b4133b417044864.exe
- Size 268KB
- SHA256 c72f4bfca93a1d3c2b1b7ed37a9bbee747f12763a761838fde4a30a5c3969359
- MD5 aeff2117dd63f1f66b4133b417044864
- SHA1 b594a87d152c77c51ad677262bee32911db3f473
- SHA512 451bced55d8fb3d92a8ab3294685468bb8fa57db334098fe6d4ad70449485c96bd4d3839c76d16831aacb5c25775ace5a185a176bcac0c09a6b90ef2177cf0c9
- MD5 SHA1 SHA512
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2