lokibot

General

Target

6cae51fec96486d2515d7c1bc72af1fbd11b7542fd768dee19bc74b470f7884d
Size

758KB
Sample

220705-znhw1segd4
MD5

7904f940590cd0315f108ecfeb642629
SHA1

5b636f5ecc153a57e34588e177e7e20fead63163
SHA256

6cae51fec96486d2515d7c1bc72af1fbd11b7542fd768dee19bc74b470f7884d
SHA512

7c6cee3abee92231e7a6043670f608a7fba55d8dd89e9dc1d88602c3274948009e255892d0a02b5fec668de69d8d97855b64d8f4cd3fdfb3035f12334a96ca0c

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://45.133.1.20/rostov2/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

http://��Ѝ��Й��Й��я��

Targets

- Target
  
  6cae51fec96486d2515d7c1bc72af1fbd11b7542fd768dee19bc74b470f7884d
- Size
  
  758KB
- MD5
  
  7904f940590cd0315f108ecfeb642629
- SHA1
  
  5b636f5ecc153a57e34588e177e7e20fead63163
- SHA256
  
  6cae51fec96486d2515d7c1bc72af1fbd11b7542fd768dee19bc74b470f7884d
- SHA512
  
  7c6cee3abee92231e7a6043670f608a7fba55d8dd89e9dc1d88602c3274948009e255892d0a02b5fec668de69d8d97855b64d8f4cd3fdfb3035f12334a96ca0c
Score

10^/10

lokibot collection spyware stealer suricata trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata
- suricata: ET MALWARE LokiBot Checkin
  suricata: ET MALWARE LokiBot Checkin
  suricata
- suricata: ET MALWARE LokiBot Fake 404 Response
  suricata: ET MALWARE LokiBot Fake 404 Response
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1