lokibot

General

Target
Wire 0092731.exe
Size 699KB
Sample220210-b34v2acba9
SHA256 78fd4e091b66540f612e7c3bd324d4bfa1abeebac2487d192f672686d09ed1a1
MD5 96fa1cd7589340e6a3fd801875e21733
SHA1 75761125485b8b0a9e8d2f9b08d891f0b8119b0f
SHA512 96ffb5d30bbddcc618ceed6c7cfe292c047ec27db75f23b552535b370cf1d3a613439b651265a930de223a891e2095e511046845f36c89e704497709c4a74af6
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://secure01-redirect.net/gd1/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  Wire 0092731.exe
- Size 699KB
- SHA256 78fd4e091b66540f612e7c3bd324d4bfa1abeebac2487d192f672686d09ed1a1
- MD5 96fa1cd7589340e6a3fd801875e21733
- SHA1 75761125485b8b0a9e8d2f9b08d891f0b8119b0f
- SHA512 96ffb5d30bbddcc618ceed6c7cfe292c047ec27db75f23b552535b370cf1d3a613439b651265a930de223a891e2095e511046845f36c89e704497709c4a74af6
- MD5 SHA1 SHA512
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2