lokibot

General

Target
8723945514e37b6d2b8f7db46a09ce82.exe
Size 682KB
Sample220411-x53awaced3
SHA256 716cef6988e3d7cc2a4bbcc7140995c280a23b2e6b54824eac031fdb4905be9b
MD5 8723945514e37b6d2b8f7db46a09ce82
SHA1 c7bf424347e32f147920933f5bfaf62fd2c94459
SHA512 e933c1ec6b2c60896013a90bbef3146b2b1623af910f7f00e3e954d2db8ab4ed86b2d5f010ca72affc7daa7f20b7e3c3aa541c433bd1570b22df5664e04a7393
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://45.133.1.45/me/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  8723945514e37b6d2b8f7db46a09ce82.exe
- Size 682KB
- SHA256 716cef6988e3d7cc2a4bbcc7140995c280a23b2e6b54824eac031fdb4905be9b
- MD5 8723945514e37b6d2b8f7db46a09ce82
- SHA1 c7bf424347e32f147920933f5bfaf62fd2c94459
- SHA512 e933c1ec6b2c60896013a90bbef3146b2b1623af910f7f00e3e954d2db8ab4ed86b2d5f010ca72affc7daa7f20b7e3c3aa541c433bd1570b22df5664e04a7393
- MD5 SHA1 SHA512
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2