lokibot

General

Target
4634c4b10c619f2023966dc25250a7e9
Size 853KB
Sample220726-ja8mhsfbar
SHA256 52cfe42d15d0f1fefd1468e01935f771ba9dfa10001b36de60ab4d805997804f
MD5 4634c4b10c619f2023966dc25250a7e9
SHA1 c4205364c90d344fb2c4f2c60404b44c3f9058da
SHA512 3f3c248a1a58c874b7908239fca14dd9d614465f571bd09b170a54236227fcbf2db98bf9ca22ec9c5197c4bd64fb14bab8e1a1b4ab9743e22d08f06a56eacbc2
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://hyatqfuh9olahvxf.ga/BN1/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  4634c4b10c619f2023966dc25250a7e9
- Size 853KB
- SHA256 52cfe42d15d0f1fefd1468e01935f771ba9dfa10001b36de60ab4d805997804f
- MD5 4634c4b10c619f2023966dc25250a7e9
- SHA1 c4205364c90d344fb2c4f2c60404b44c3f9058da
- SHA512 3f3c248a1a58c874b7908239fca14dd9d614465f571bd09b170a54236227fcbf2db98bf9ca22ec9c5197c4bd64fb14bab8e1a1b4ab9743e22d08f06a56eacbc2
- MD5 SHA1 SHA512
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2