lokibot

General

Target

3aeb0f6507a5ebf8a7d7004507fc721c060f43a86b80605ac89db37b7e2fb15e
Size

104KB
Sample

220703-w19zgsdhh5
MD5

7f8601a24da0b3b6700a6f047657128a
SHA1

e515045c2c79060a7a0758f50f8f37098583a30e
SHA256

3aeb0f6507a5ebf8a7d7004507fc721c060f43a86b80605ac89db37b7e2fb15e
SHA512

8db18c4a0d390e499f9571d576a59da3518a3eb2ae75c1ca427e01c2649e0fe4e26bd5e062d9c210a26f1557b2936a26153d0756b0b8667a0a60734ab7d378af

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://execuitiveship.com/destiny/unfold/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  3aeb0f6507a5ebf8a7d7004507fc721c060f43a86b80605ac89db37b7e2fb15e
- Size
  
  104KB
- MD5
  
  7f8601a24da0b3b6700a6f047657128a
- SHA1
  
  e515045c2c79060a7a0758f50f8f37098583a30e
- SHA256
  
  3aeb0f6507a5ebf8a7d7004507fc721c060f43a86b80605ac89db37b7e2fb15e
- SHA512
  
  8db18c4a0d390e499f9571d576a59da3518a3eb2ae75c1ca427e01c2649e0fe4e26bd5e062d9c210a26f1557b2936a26153d0756b0b8667a0a60734ab7d378af
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2