lokibot

General

Target

Approved purchase order number PO2022070012.exe
Size

592KB
Sample

220725-k43h2abgcp
MD5

e06695c163531f7089ca1b243ee8873f
SHA1

aa90d5f607fcdf8bce905a5f1ba8e2de4765fdf3
SHA256

6e69038d76d420bc65eedac8eb5c5b727303efdff971bb7ad8b8f3b4deee8a45
SHA512

7be6f6bb944a17898efaee35c56337437d0399fccefe13bd1649fbb58a68ba4bd847b22849599b90708b64e51c8963952d79cb001910268c23bdf6e58fe7a890

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/gi15/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  Approved purchase order number PO2022070012.exe
- Size
  
  592KB
- MD5
  
  e06695c163531f7089ca1b243ee8873f
- SHA1
  
  aa90d5f607fcdf8bce905a5f1ba8e2de4765fdf3
- SHA256
  
  6e69038d76d420bc65eedac8eb5c5b727303efdff971bb7ad8b8f3b4deee8a45
- SHA512
  
  7be6f6bb944a17898efaee35c56337437d0399fccefe13bd1649fbb58a68ba4bd847b22849599b90708b64e51c8963952d79cb001910268c23bdf6e58fe7a890
Score

10^/10

lokibot collection evasion spyware stealer suricata trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- suricata: ET MALWARE LokiBot Checkin
  suricata: ET MALWARE LokiBot Checkin
  suricata
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata
- Looks for VirtualBox Guest Additions in registry
  evasion
- Nirsoft
- Executes dropped EXE
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
- Accesses Microsoft Outlook profiles
  collection
- Checks whether UAC is enabled
  evasion trojan
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2