lokibot

General

Target

f6dfd12e436b1efe4b9ab1188974fed5
Size

243KB
Sample

220707-gae9vsdhbr
MD5

f6dfd12e436b1efe4b9ab1188974fed5
SHA1

690bac56db81acf27b04a96a41e2085bc42c25c6
SHA256

344d78cfa8b56b6a8994e89687059bd85c31e55ac12530c6b33dcf0e88d94ac6
SHA512

b9fe2bfdfc3452073a13a7930a9560cacf9fad7094928eb9c7bde341d5d15a3200a7159987566505d2be8f51361e18544a617386e98ac8b9cf127c54cba289da

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://45.133.1.20/rostov2/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

http://��Ѝ��Й��Й��я��

Targets

- Target
  
  PO 1001873.xlsx
- Size
  
  176KB
- MD5
  
  336bce75fab2c892587c5d6d3b27c360
- SHA1
  
  60c8262aba8872e7d33451950107a5c1101933be
- SHA256
  
  aa4c2e7346fc37bbf38fed52341d14b84b56cfe523c1d6f8e0eccea78f257e22
- SHA512
  
  5a0e3a1c4f313987681ea91b362d2883a71f20091cc967598050f59cfc5917364d5ad46aa1e4c67a12154ca0f4331aae0b32f1e1e8956a8a8d1a32f5ea4813a7
Score

10^/10

lokibot collection spyware stealer suricata trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata
- suricata: ET MALWARE LokiBot Checkin
  suricata: ET MALWARE LokiBot Checkin
  suricata
- suricata: ET MALWARE LokiBot Fake 404 Response
  suricata: ET MALWARE LokiBot Fake 404 Response
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata
- suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016
  suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016
  suricata
- suricata: ET MALWARE Possible Malicious Macro EXE DL AlphaNumL
  suricata: ET MALWARE Possible Malicious Macro EXE DL AlphaNumL
  suricata
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2