lokibot

General

Target

70579d36545b49ee662bcca992195ea1d5cd794b47e94c03cc26ebca8eb00426
Size

577KB
Sample

220707-cr16faeag9
MD5

f5353b30a9cd70cf9ee0f398606ac050
SHA1

0fe90c5dea3114832f9ce915d14ab58e763b46de
SHA256

70579d36545b49ee662bcca992195ea1d5cd794b47e94c03cc26ebca8eb00426
SHA512

d61ca4c17a6202270ec268f94d9df27b4b8b4cd90448d2572353c5ba40bc42f9b43748c5cdd017e02c812f0ef7adda130007f85a1a654614261ed36c796f2e88

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://45.133.1.20/rostov2/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

http://��Ѝ��Й��Й��я��

Targets

- Target
  
  70579d36545b49ee662bcca992195ea1d5cd794b47e94c03cc26ebca8eb00426
- Size
  
  577KB
- MD5
  
  f5353b30a9cd70cf9ee0f398606ac050
- SHA1
  
  0fe90c5dea3114832f9ce915d14ab58e763b46de
- SHA256
  
  70579d36545b49ee662bcca992195ea1d5cd794b47e94c03cc26ebca8eb00426
- SHA512
  
  d61ca4c17a6202270ec268f94d9df27b4b8b4cd90448d2572353c5ba40bc42f9b43748c5cdd017e02c812f0ef7adda130007f85a1a654614261ed36c796f2e88
Score

10^/10

lokibot collection spyware stealer suricata trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata
- suricata: ET MALWARE LokiBot Checkin
  suricata: ET MALWARE LokiBot Checkin
  suricata
- suricata: ET MALWARE LokiBot Fake 404 Response
  suricata: ET MALWARE LokiBot Fake 404 Response
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1