lokibot

General

Target
Pago-21012200.pdf.exe
Size 735KB
Sample220121-x6m8caaha2
SHA256 e12350c828d476da95d1afb8cfbd73e061ab9596a4303848687e925f3627ca35
MD5 cdefe8d30624f6193fd927f42b9c4b1a
SHA1 a77c3bfb659883d8db0f24cc0dea3c556e95fea5
SHA512 1f7a7b09d05a05d589ba1f2490255cb47463e9c919419b84ced10e2d5705611dc6ded710f2ee261a02142382810271a6abefc69d40f96479f5708025fbb4e637
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://aboasu.xyz/xx/za/mm.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  Pago-21012200.pdf.exe
- Size 735KB
- SHA256 e12350c828d476da95d1afb8cfbd73e061ab9596a4303848687e925f3627ca35
- MD5 cdefe8d30624f6193fd927f42b9c4b1a
- SHA1 a77c3bfb659883d8db0f24cc0dea3c556e95fea5
- SHA512 1f7a7b09d05a05d589ba1f2490255cb47463e9c919419b84ced10e2d5705611dc6ded710f2ee261a02142382810271a6abefc69d40f96479f5708025fbb4e637
- MD5 SHA1 SHA512
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2