lokibot

General

Target
SKNX-M-PO-105.exe
Size 869KB
Sample220902-c6ewrahbg4
SHA256 ec34ace43bdd59c6eb3d53b73df0736265197372dbd0b606fe41afa059d2c220
MD5 f0d0cee0e7e974c8a628325a748952bc
SHA1 50e3c92ee3ed4542a5fd65419ffd73055b6329d5
SHA512 08c71385eb7d7a3f9cd12ad452b4f57834dfe8b340c0656af2b9dcdbd7ee2034020dd8279a4c10da160f0dcda2c50a3ca851839b99200c2a38dd1658f1785865
SSDEEP 12288:C68DF75exgPwqoXY+mzoRtbvRT7V8S724wRg39C4e+a+bGWeDXFC5UxvYZa:+Z5YXY+mzo3bvvT7twSNCiqxBC52v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://162.213.249.190/?hello00x
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  SKNX-M-PO-105.exe
- Size 869KB
- SHA256 ec34ace43bdd59c6eb3d53b73df0736265197372dbd0b606fe41afa059d2c220
- MD5 f0d0cee0e7e974c8a628325a748952bc
- SHA1 50e3c92ee3ed4542a5fd65419ffd73055b6329d5
- SHA512 08c71385eb7d7a3f9cd12ad452b4f57834dfe8b340c0656af2b9dcdbd7ee2034020dd8279a4c10da160f0dcda2c50a3ca851839b99200c2a38dd1658f1785865
- SSDEEP 12288:C68DF75exgPwqoXY+mzoRtbvRT7V8S724wRg39C4e+a+bGWeDXFC5UxvYZa:+Z5YXY+mzo3bvvT7twSNCiqxBC52v
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2