lokibot

General

Target
Dhl Pdf.exe
Size 281KB
Sample211223-kce9eshch6
SHA256 9a4af8552461d8511d210cdf72ea1f56f13ef6d577dc2d836d4736606423f64e
MD5 22f299746520203220f9c9e2814ab671
SHA1 087f7f78ba24bb5ab51f7eed86f45bb374d2e2e4
SHA512 f4947325f0375d1308b68244eea4de7f60de4a5a8df0b3b4eda4da880354647096a41297fd3983291c6847140aa00dec350364e4d0390c417235b07f92be9cdc
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://gobonamud.gq/temple/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  Dhl Pdf.exe
- Size 281KB
- SHA256 9a4af8552461d8511d210cdf72ea1f56f13ef6d577dc2d836d4736606423f64e
- MD5 22f299746520203220f9c9e2814ab671
- SHA1 087f7f78ba24bb5ab51f7eed86f45bb374d2e2e4
- SHA512 f4947325f0375d1308b68244eea4de7f60de4a5a8df0b3b4eda4da880354647096a41297fd3983291c6847140aa00dec350364e4d0390c417235b07f92be9cdc
- MD5 SHA1 SHA512
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2