lokibot

General

Target

Product_Specification_Sheet.xlsx
Size

176KB
Sample

220705-pffrksahe7
MD5

b2772feb6b37db8842965a0b8ade9aa7
SHA1

8e72eef2605697037cd03d1fddc02a88a0e9bf85
SHA256

df7d03dcb311c783a90924ef8afdb78227229d45410272cf03c3e98742d040ad
SHA512

5f88a788cb51e61f941cf1d4d06fd25099abf2eafd0f3eca4551a32a7c5b198ab58c7bb26948020c38c4961f73be8661948cf32636e3bb6b02aa605b78c6a776

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://37.0.11.227/rostov1/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

http://��Ѝ��Й��Й��я��

Targets

- Target
  
  Product_Specification_Sheet.xlsx
- Size
  
  176KB
- MD5
  
  b2772feb6b37db8842965a0b8ade9aa7
- SHA1
  
  8e72eef2605697037cd03d1fddc02a88a0e9bf85
- SHA256
  
  df7d03dcb311c783a90924ef8afdb78227229d45410272cf03c3e98742d040ad
- SHA512
  
  5f88a788cb51e61f941cf1d4d06fd25099abf2eafd0f3eca4551a32a7c5b198ab58c7bb26948020c38c4961f73be8661948cf32636e3bb6b02aa605b78c6a776
Score

10^/10

lokibot collection spyware stealer suricata trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata
- suricata: ET MALWARE LokiBot Checkin
  suricata: ET MALWARE LokiBot Checkin
  suricata
- suricata: ET MALWARE LokiBot Fake 404 Response
  suricata: ET MALWARE LokiBot Fake 404 Response
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata
- suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016
  suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016
  suricata
- suricata: ET MALWARE Possible Malicious Macro EXE DL AlphaNumL
  suricata: ET MALWARE Possible Malicious Macro EXE DL AlphaNumL
  suricata
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2