lokibot

General

Target

remittance form.xlsx
Size

176KB
Sample

220707-ggamysgcb4
MD5

7bc0420754dd5a00b96c9b249820404a
SHA1

90370dcfd338df51a30fb4f4493849421f3d6268
SHA256

d61b93d7d41c2a9f2553ebb03045ccd9e00ee86bff4c7288444bb0e9b9a5ca3f
SHA512

9666a1346f7c247b672343e7fe4c96f66c1c4a6b012ac1945211eaafa5898faf7baa00fea4edfadaffbce8820d92efbf009010b940d782aeb2cdf4e728c87090

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://62.197.136.176/health4/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

http://��З��Й��Й��я��

Targets

- Target
  
  remittance form.xlsx
- Size
  
  176KB
- MD5
  
  7bc0420754dd5a00b96c9b249820404a
- SHA1
  
  90370dcfd338df51a30fb4f4493849421f3d6268
- SHA256
  
  d61b93d7d41c2a9f2553ebb03045ccd9e00ee86bff4c7288444bb0e9b9a5ca3f
- SHA512
  
  9666a1346f7c247b672343e7fe4c96f66c1c4a6b012ac1945211eaafa5898faf7baa00fea4edfadaffbce8820d92efbf009010b940d782aeb2cdf4e728c87090
Score

10^/10

lokibot collection spyware stealer suricata trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata
- suricata: ET MALWARE LokiBot Checkin
  suricata: ET MALWARE LokiBot Checkin
  suricata
- suricata: ET MALWARE LokiBot Fake 404 Response
  suricata: ET MALWARE LokiBot Fake 404 Response
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata
- suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016
  suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016
  suricata
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2