lokibot

General

Target

Customer payment Recipeties....exe
Size

176KB
Sample

220705-ggv9nagdf8
MD5

ecddefce8cf4776956c6b460612128c7
SHA1

8812b2e1b8237f92ad952d34e2f1bacef7b93a48
SHA256

8228980582876a9da9e46304e1a738af7485b0c7992c9daf30004d8bab1c3b9d
SHA512

472581780de722dec6355d57bc6d007a200e7af99a460a81f30ad7e5027e4ce6aeee8f0d433ff9cc2683f5ebbb31d0d29147f02079a342128a530b80c9b2b6bb

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

https://rnileniaexpress.com/bright/five/PvqDq929BSx_A_D_M1n_a.php?Ubkz=cPMwALGdgRR

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  Customer payment Recipeties....exe
- Size
  
  176KB
- MD5
  
  ecddefce8cf4776956c6b460612128c7
- SHA1
  
  8812b2e1b8237f92ad952d34e2f1bacef7b93a48
- SHA256
  
  8228980582876a9da9e46304e1a738af7485b0c7992c9daf30004d8bab1c3b9d
- SHA512
  
  472581780de722dec6355d57bc6d007a200e7af99a460a81f30ad7e5027e4ce6aeee8f0d433ff9cc2683f5ebbb31d0d29147f02079a342128a530b80c9b2b6bb
Score

10^/10

lokibot collection spyware stealer suricata trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata
- suricata: ET MALWARE LokiBot Checkin
  suricata: ET MALWARE LokiBot Checkin
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2