lokibot

General

Target
cec9964e1ec53bf5a511db1ba571de05.exe
Size 591KB
Sample220815-tk8qdaffh4
SHA256 52f0382ddec3efb2c092b4199fb537eebd8cbd1ed1fa0ed321fea2a723dffc13
MD5 cec9964e1ec53bf5a511db1ba571de05
SHA1 d3c7cd60637e54958ee558d995cc77c57e5d7456
SHA512 3f476b4b920f4d0311eaf0d4fcb89cfa2d2195144e7bbbb9b04c3d3535c66f03fb3a4ae570428be2a4b145b27114d985ba8bc517ba4be520a187eab650a39946
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://208.67.105.148/nze/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  cec9964e1ec53bf5a511db1ba571de05.exe
- Size 591KB
- SHA256 52f0382ddec3efb2c092b4199fb537eebd8cbd1ed1fa0ed321fea2a723dffc13
- MD5 cec9964e1ec53bf5a511db1ba571de05
- SHA1 d3c7cd60637e54958ee558d995cc77c57e5d7456
- SHA512 3f476b4b920f4d0311eaf0d4fcb89cfa2d2195144e7bbbb9b04c3d3535c66f03fb3a4ae570428be2a4b145b27114d985ba8bc517ba4be520a187eab650a39946
- MD5 SHA1 SHA512
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2