lokibot

General

Target
PO 20220203-031.exe
Size 429KB
Sample220203-jjrelaecg2
SHA256 edb10d2dcc32d8eec38ad1db628e83ce08cfa41d9b973697853efbc3e868f86a
MD5 5c027e96da77f614b39cd26a817e4988
SHA1 723503b251a0e9c8714d10564f8c53b573b8713d
SHA512 3bef2f5cbb7c94c2844ab0e4da73dc41fbdbdc20d7cba4cdbcfc605443635083d54dbbe6fff88678ae2d2de1b55969d25c6a6f42aba1f581ffca428ec8db793f
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://128.199.46.58/~hgyf/?search=05ed102d2c885c8d117c929fb3e189bf
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  PO 20220203-031.exe
- Size 429KB
- SHA256 edb10d2dcc32d8eec38ad1db628e83ce08cfa41d9b973697853efbc3e868f86a
- MD5 5c027e96da77f614b39cd26a817e4988
- SHA1 723503b251a0e9c8714d10564f8c53b573b8713d
- SHA512 3bef2f5cbb7c94c2844ab0e4da73dc41fbdbdc20d7cba4cdbcfc605443635083d54dbbe6fff88678ae2d2de1b55969d25c6a6f42aba1f581ffca428ec8db793f
- MD5 SHA1 SHA512
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2