lokibot

General

Target

bd90755c673a1aa9fafbaccc3868c554d0470ca4530f987b76ad4ce5486fba92
Size

582KB
Sample

220707-k3r1xaacdl
MD5

cff952f91a2a74041df50efd76d39880
SHA1

09c18f0feedc09a56741d59d568b862dbabea26f
SHA256

bd90755c673a1aa9fafbaccc3868c554d0470ca4530f987b76ad4ce5486fba92
SHA512

4bc8d7775891ce54386fea2cf8a7183a39fbe4f0a14039e030270c9dc13fd88412c5cb774ab90af344f9f98ff06df17a2286e455ce8fdcb2e23d863f999218e3

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/gh20/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  bd90755c673a1aa9fafbaccc3868c554d0470ca4530f987b76ad4ce5486fba92
- Size
  
  582KB
- MD5
  
  cff952f91a2a74041df50efd76d39880
- SHA1
  
  09c18f0feedc09a56741d59d568b862dbabea26f
- SHA256
  
  bd90755c673a1aa9fafbaccc3868c554d0470ca4530f987b76ad4ce5486fba92
- SHA512
  
  4bc8d7775891ce54386fea2cf8a7183a39fbe4f0a14039e030270c9dc13fd88412c5cb774ab90af344f9f98ff06df17a2286e455ce8fdcb2e23d863f999218e3
Score

10^/10

lokibot collection spyware stealer suricata trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata
- suricata: ET MALWARE LokiBot Checkin
  suricata: ET MALWARE LokiBot Checkin
  suricata
- suricata: ET MALWARE LokiBot Fake 404 Response
  suricata: ET MALWARE LokiBot Fake 404 Response
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1