lokibot

General

Target

39d9174afca195e57ea97337b59d14ac12242a51743eee613266ba7ade4eee0a
Size

178KB
Sample

220701-r7a2hsghak
MD5

cdda1488d150b068fcfaef4bd08d4b21
SHA1

f52133d85509ac1de0eb554ba406840395d1de4c
SHA256

39d9174afca195e57ea97337b59d14ac12242a51743eee613266ba7ade4eee0a
SHA512

b4627150da9eee622947689a53633071077db195e901379ac3837a73aab55e4ab004d0fffc88bfbff0ae58b04f66a023a63b57dfc6f280041264aac17377ee3c

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://dadatiles.com.au/wpjp/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

http://��ќ��ў�Ј��Я��Й��Й��я��

Targets

- Target
  
  32155.exe
- Size
  
  307KB
- MD5
  
  9ae65068e90b662f412e6304436ccf25
- SHA1
  
  50e9e4fd05d09189579cb5d8a56c5563939be2eb
- SHA256
  
  e9d1c820705d2ed4b3506f0fcc5fa5f89d54a70daf9dc4f28e58ee57bfdf1174
- SHA512
  
  22b288c5d9311648fa9c13ef2ad9798d4c6c2348d3cf38fceb56da077f13638db708e89b57194efaf61fcf08d42094a06009e3007c5e26b87ee01e84f144c111
Score

10^/10

lokibot spyware stealer trojan collection suricata
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata
- suricata: ET MALWARE LokiBot Checkin
  suricata: ET MALWARE LokiBot Checkin
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2