lokibot

General

Target

Electronic Funds TT.xlsx
Size

176KB
Sample

220704-wm1hwscef6
MD5

338f65dfd7adebb7e42da3ad001e46b3
SHA1

234e9f2637df1942d818b4b31aeea109e16e7b4f
SHA256

51f2a6bc3924202ea499d130c6439d3f372438884731641622101690733a35e9
SHA512

741b810efbf341f781fe8d0be65b2d1f6e4273897359f1af59a2467704089f0522794fb4af5d074b03fe00f33b80bf7fd8a590c01246d2c6977e48719c3568b3

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://hyatqfuh9olahvxf.ga/BN1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  Electronic Funds TT.xlsx
- Size
  
  176KB
- MD5
  
  338f65dfd7adebb7e42da3ad001e46b3
- SHA1
  
  234e9f2637df1942d818b4b31aeea109e16e7b4f
- SHA256
  
  51f2a6bc3924202ea499d130c6439d3f372438884731641622101690733a35e9
- SHA512
  
  741b810efbf341f781fe8d0be65b2d1f6e4273897359f1af59a2467704089f0522794fb4af5d074b03fe00f33b80bf7fd8a590c01246d2c6977e48719c3568b3
Score

10^/10

lokibot collection spyware stealer suricata trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata
- suricata: ET MALWARE LokiBot Checkin
  suricata: ET MALWARE LokiBot Checkin
  suricata
- suricata: ET MALWARE LokiBot Fake 404 Response
  suricata: ET MALWARE LokiBot Fake 404 Response
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata
- suricata: ET MALWARE MSIL/GenKryptik.FQRH Download Request
  suricata: ET MALWARE MSIL/GenKryptik.FQRH Download Request
  suricata
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2