lokibot

General

Target

da6abf1cf5f714cb5ce1529f5e2ef93201325fb9eb45af81fd22d82fb3857d77.exe
Size

42KB
Sample

220514-q5jefaccfr
MD5

f0f88a07d09f67166c66928fba2acec7
SHA1

df73292977606a0a5d5b53bcdf638dd042b8dbc5
SHA256

da6abf1cf5f714cb5ce1529f5e2ef93201325fb9eb45af81fd22d82fb3857d77
SHA512

27e10e7658543dd1ee9c8abdd999e1849beef0d9ef23447902c7b845901670b9d03fb5129d7815af0865f81e2749f8bde873cac30bde026a9a08a4ca7c65c238

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://198.187.30.47/p.php?id=7706107617708711

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  da6abf1cf5f714cb5ce1529f5e2ef93201325fb9eb45af81fd22d82fb3857d77.exe
- Size
  
  42KB
- MD5
  
  f0f88a07d09f67166c66928fba2acec7
- SHA1
  
  df73292977606a0a5d5b53bcdf638dd042b8dbc5
- SHA256
  
  da6abf1cf5f714cb5ce1529f5e2ef93201325fb9eb45af81fd22d82fb3857d77
- SHA512
  
  27e10e7658543dd1ee9c8abdd999e1849beef0d9ef23447902c7b845901670b9d03fb5129d7815af0865f81e2749f8bde873cac30bde026a9a08a4ca7c65c238
Score

10^/10

lokibot collection persistence spyware stealer suricata trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata
- suricata: ET MALWARE LokiBot Checkin
  suricata: ET MALWARE LokiBot Checkin
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2