lokibot

General

Target

NOO5789909_1.zip
Size

536KB
Sample

220923-hsmx4addf3
MD5

bf178d5af99105ea319db8e550a7b536
SHA1

430acc7ecc791e862b089e85b9084ba94e7b8b65
SHA256

456943104e33b4e6cf94baeb6743014dd884d46b1a5a423969521f104edb7f9d
SHA512

255cf8febaf266627ece575554265d0405405c5a6ab4b727de7fd132f7c8991b6509e2d7edbc7bf9599bcb66b99a2ea8115a0ad2f1f333feda3f0e3a43115df1
SSDEEP

12288:MdD811RHTrSy9EWgoQYK0ty3nuN5VPl58Oj0dtlq1Chn:OwrHEWgoQ30ty3nuN5df0tlJ

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/gk3/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  NOO5789909.exe
- Size
  
  819KB
- MD5
  
  869c61a9af412707d9b8a3bee00349ff
- SHA1
  
  99c29aab339a729a80adcc3d8510c10d384f4379
- SHA256
  
  db382b74819cd4431972a7fcd845aaab7c62ff55c5bcedf92af38a17be07194e
- SHA512
  
  d9df3d87fd7642eba3fbc9524242d7cb49a005420448135a79cedb38febcd24b5f1831bdbda3ecd544a7e7c033cbc73716972d1411f6a506868995c768570160
- SSDEEP
  
  12288:eOx8OH504YWyrGrsHXrKaTEeg2iYSAtynnuzR7PlniO90/tTgD5JYC+kMTlY:gkyPjEeg2iRAtynnuzRLFWtTa
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2