lokibot

General

Target
4852a190e8e3a53a2939820ca1c072fa.exe
Size 910KB
Sample221011-md8ngaaagp
SHA256 4fd08e621dd3e7f5f3aa09d04caebea182836ddf051693b2cae080cb671cd672
MD5 4852a190e8e3a53a2939820ca1c072fa
SHA1 390723c31b2ba935fe00be951e79e15863ca3da3
SHA512 3ae167c1b3e78a6553aa779cf531e24d8c1ed937b6b16f80e90ec8603269816b4e0dd812d263679b498bd0839c7cc62ad04e89a43f732ca2f9e1ff7a2a33f3b9
SSDEEP 12288:/VwAvY8aJWNqZf3gl4GhSrz4/V0UCC3Cy9AwAQSQy4A:9Y8aJWIZf3gl4GSrE90/wCyfAtQy4A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://208.67.105.162/smart/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  4852a190e8e3a53a2939820ca1c072fa.exe
- Size 910KB
- SHA256 4fd08e621dd3e7f5f3aa09d04caebea182836ddf051693b2cae080cb671cd672
- MD5 4852a190e8e3a53a2939820ca1c072fa
- SHA1 390723c31b2ba935fe00be951e79e15863ca3da3
- SHA512 3ae167c1b3e78a6553aa779cf531e24d8c1ed937b6b16f80e90ec8603269816b4e0dd812d263679b498bd0839c7cc62ad04e89a43f732ca2f9e1ff7a2a33f3b9
- SSDEEP 12288:/VwAvY8aJWNqZf3gl4GhSrz4/V0UCC3Cy9AwAQSQy4A:9Y8aJWIZf3gl4GSrE90/wCyfAtQy4A
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2