lokibot

General

Target
Proforma_Invoice_SK20220327_pdf.exe
Size 626KB
Sample220412-rc9llafdc2
SHA256 d19b39018d752b434f68ab8d567f1eaf9a7e93934e1d8ed3737e64f9fdcec85c
MD5 eeb961d889d30082b5fc2b99b23ad977
SHA1 3824fdd2145a20360b84d32a6057cf01425a0012
SHA512 fe748f28c740aab18d5b62c357779afee1a1636d933f4880bd175c31ecc17096f4abf7f5c6f7aef422f185307fb9eff55c094b48f4cc245119887a36756d797f
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/ge17/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  Proforma_Invoice_SK20220327_pdf.exe
- Size 626KB
- SHA256 d19b39018d752b434f68ab8d567f1eaf9a7e93934e1d8ed3737e64f9fdcec85c
- MD5 eeb961d889d30082b5fc2b99b23ad977
- SHA1 3824fdd2145a20360b84d32a6057cf01425a0012
- SHA512 fe748f28c740aab18d5b62c357779afee1a1636d933f4880bd175c31ecc17096f4abf7f5c6f7aef422f185307fb9eff55c094b48f4cc245119887a36756d797f
- MD5 SHA1 SHA512
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2