lokibot

General

Target
Order PO#188827-003209.exe
Size 694KB
Sample220824-cwvt8agba3
SHA256 1ca7cdf43e6db8fbeb7bd699b191bc593e85909b51a380a8b02f394165f3ec4e
MD5 b1bf9668c5f9f3ec7d734d7b1c19dfaf
SHA1 0e9d4e1e1b325a0a7a229a3f5de86940098e8e2a
SHA512 6bd40b2ca40e1b5d26e9bc37f84e2e3e0a88be90d7b46de63b0350b2aa05d260bbafa9b33e46cc95d801c13adc4b27a538eafa0438f2270219bb67cfe46d9398
SSDEEP 12288:2z9NfLN7eu3XDG2kbpYfeheeuumaWMxg8YFf4BxOnTh6M04M:ErfLN7BG2kbKl3aW4cnl6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://162.213.249.190/?xgold
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  Order PO#188827-003209.exe
- Size 694KB
- SHA256 1ca7cdf43e6db8fbeb7bd699b191bc593e85909b51a380a8b02f394165f3ec4e
- MD5 b1bf9668c5f9f3ec7d734d7b1c19dfaf
- SHA1 0e9d4e1e1b325a0a7a229a3f5de86940098e8e2a
- SHA512 6bd40b2ca40e1b5d26e9bc37f84e2e3e0a88be90d7b46de63b0350b2aa05d260bbafa9b33e46cc95d801c13adc4b27a538eafa0438f2270219bb67cfe46d9398
- SSDEEP 12288:2z9NfLN7eu3XDG2kbpYfeheeuumaWMxg8YFf4BxOnTh6M04M:ErfLN7BG2kbKl3aW4cnl6
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2