lokibot

General

Target

B9E4E390763879F79AC0E6D5C331B4997537E468790BE.exe
Size

190KB
Sample

221001-x8cvdsdfbr
MD5

150200938ebe72156371e05f96e8f2f6
SHA1

5d8f8dc772e57421ac48104868a6050a8f970650
SHA256

b9e4e390763879f79ac0e6d5c331b4997537e468790be0e7ca3f021c77169d9f
SHA512

c697ba47bf10ca74542f7c80559ffe77a37456b1eddc853fbbc727d7d95cb28cb82e2a5acae7e558c0b53a56411a15440ec2ddcbd24fa76cf1cecdb5f90f6b1f
SSDEEP

3072:60oKFo6hLnX/K9G4a8WID563GcEplbiaBxbbCUvbE0isERfIzd69l2GtN1DOf+fH:6TM/kWID56JE3iaBxbbCOqIx69l2GtN/

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://siiigroup.com/men/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  B9E4E390763879F79AC0E6D5C331B4997537E468790BE.exe
- Size
  
  190KB
- MD5
  
  150200938ebe72156371e05f96e8f2f6
- SHA1
  
  5d8f8dc772e57421ac48104868a6050a8f970650
- SHA256
  
  b9e4e390763879f79ac0e6d5c331b4997537e468790be0e7ca3f021c77169d9f
- SHA512
  
  c697ba47bf10ca74542f7c80559ffe77a37456b1eddc853fbbc727d7d95cb28cb82e2a5acae7e558c0b53a56411a15440ec2ddcbd24fa76cf1cecdb5f90f6b1f
- SSDEEP
  
  3072:60oKFo6hLnX/K9G4a8WID563GcEplbiaBxbbCUvbE0isERfIzd69l2GtN1DOf+fH:6TM/kWID56JE3iaBxbbCOqIx69l2GtN/
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2