lokibot

General

Target

462f28cd4d65b31132e10089945663daf4b23d6c43a1c3d576e9cd35f3597606
Size

623KB
Sample

220707-lje3nsdbe7
MD5

bbd98954a7a985e567d0b4d8a31bdc23
SHA1

cba56132198878a1030152d9be2fc960775c6aed
SHA256

462f28cd4d65b31132e10089945663daf4b23d6c43a1c3d576e9cd35f3597606
SHA512

2501241c5694f0d125a0cda4b77ec367bbccd817473897251da3287aaedf20cce74b119b010967b6aaeb7559c7cede2dd85d2c01d7062cc32ac2225e9459d1c2

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://51.89.163.167/1lk/p/cat.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  462f28cd4d65b31132e10089945663daf4b23d6c43a1c3d576e9cd35f3597606
- Size
  
  623KB
- MD5
  
  bbd98954a7a985e567d0b4d8a31bdc23
- SHA1
  
  cba56132198878a1030152d9be2fc960775c6aed
- SHA256
  
  462f28cd4d65b31132e10089945663daf4b23d6c43a1c3d576e9cd35f3597606
- SHA512
  
  2501241c5694f0d125a0cda4b77ec367bbccd817473897251da3287aaedf20cce74b119b010967b6aaeb7559c7cede2dd85d2c01d7062cc32ac2225e9459d1c2
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes dropped EXE

Drops startup file

Loads dropped DLL

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2