lokibot

General

Target

21b58ced0bde178a02008f0140786eee77dfa27651673881c76538e54b7ce34c
Size

550KB
Sample

220704-j97jhaffbm
MD5

87cb5e766fcebfe369c3407389d46ff0
SHA1

bd2a631e0c15743396ec0977bee3513d2f4c1c64
SHA256

21b58ced0bde178a02008f0140786eee77dfa27651673881c76538e54b7ce34c
SHA512

ed12db0e09f96a8a6436953c32112f93551a152024b5fcac88a85b67abe3b549c2f9e592d6a608e3b3e2f8a47fe613c44300ffc28bcaa285968ee2c3c7a6635c

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://62.197.136.176/health4/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

http://��З��Й��Й��я��

Targets

- Target
  
  21b58ced0bde178a02008f0140786eee77dfa27651673881c76538e54b7ce34c
- Size
  
  550KB
- MD5
  
  87cb5e766fcebfe369c3407389d46ff0
- SHA1
  
  bd2a631e0c15743396ec0977bee3513d2f4c1c64
- SHA256
  
  21b58ced0bde178a02008f0140786eee77dfa27651673881c76538e54b7ce34c
- SHA512
  
  ed12db0e09f96a8a6436953c32112f93551a152024b5fcac88a85b67abe3b549c2f9e592d6a608e3b3e2f8a47fe613c44300ffc28bcaa285968ee2c3c7a6635c
Score

10^/10

lokibot collection spyware stealer suricata trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata
- suricata: ET MALWARE LokiBot Checkin
  suricata: ET MALWARE LokiBot Checkin
  suricata
- suricata: ET MALWARE LokiBot Fake 404 Response
  suricata: ET MALWARE LokiBot Fake 404 Response
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1