lokibot

General

Target

16710857-c008-4739-bb7e-f08e65ac436b.xlsx
Size

163KB
Sample

220704-d4kvnaecek
MD5

30b1fd70a186c3f5b97c048f7410f5fb
SHA1

b62d00058ee411ca0b67e037f0161bb2cd4b933d
SHA256

4db92f47581c098f95b65660681bd0540079dcc470af35e304a7aa656c051708
SHA512

e09c1464b8137e0245e38a260717fd04473a5136cc780d38f7ecac3ff3e8de9ea322e1ae2a3ee8622d33f22c6e31584fd3e4c45cb584c29583d9413c6976edfc

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/gf10/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  16710857-c008-4739-bb7e-f08e65ac436b.xlsx
- Size
  
  163KB
- MD5
  
  30b1fd70a186c3f5b97c048f7410f5fb
- SHA1
  
  b62d00058ee411ca0b67e037f0161bb2cd4b933d
- SHA256
  
  4db92f47581c098f95b65660681bd0540079dcc470af35e304a7aa656c051708
- SHA512
  
  e09c1464b8137e0245e38a260717fd04473a5136cc780d38f7ecac3ff3e8de9ea322e1ae2a3ee8622d33f22c6e31584fd3e4c45cb584c29583d9413c6976edfc
Score

10^/10

lokibot collection spyware stealer suricata trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata
- suricata: ET MALWARE LokiBot Checkin
  suricata: ET MALWARE LokiBot Checkin
  suricata
- suricata: ET MALWARE LokiBot Fake 404 Response
  suricata: ET MALWARE LokiBot Fake 404 Response
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata
- suricata: ET MALWARE MSIL/GenKryptik.FQRH Download Request
  suricata: ET MALWARE MSIL/GenKryptik.FQRH Download Request
  suricata
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2