lokibot

General

Target
Bankslip_Copy_Scan0041_pdf.exe
Size 834KB
Sample220906-p6c4dadbd9
SHA256 2566c8b7a7a73671cc185388a519d68b795b82b1a7bcd69c5cbeefe1aa0a3fea
MD5 60852ef7f129a88a93384c4aefa0088b
SHA1 752083684dea53291c7ed000c81899a6cd6f9604
SHA512 3e824ceeb39c16394b301d6ac0c1e10a5c28fc86a3e2fefa348283ceaf58d0b734a93978a096b88ffe5b6af477c803be17f0ec4f1523b65e3a23d236da2bef66
SSDEEP 12288:tsUokn0r397RG72Na4zN22e57MJC23kTxj:ukn0rtFha4zNre5oJn3kT1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/gj23/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  Bankslip_Copy_Scan0041_pdf.exe
- Size 834KB
- SHA256 2566c8b7a7a73671cc185388a519d68b795b82b1a7bcd69c5cbeefe1aa0a3fea
- MD5 60852ef7f129a88a93384c4aefa0088b
- SHA1 752083684dea53291c7ed000c81899a6cd6f9604
- SHA512 3e824ceeb39c16394b301d6ac0c1e10a5c28fc86a3e2fefa348283ceaf58d0b734a93978a096b88ffe5b6af477c803be17f0ec4f1523b65e3a23d236da2bef66
- SSDEEP 12288:tsUokn0r397RG72Na4zN22e57MJC23kTxj:ukn0rtFha4zNre5oJn3kT1
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2