lokibot

General

Target

12a0ce43670ef1671689d0abc53412d25c5e5494e6a04e1c1cbb5b88766c1921
Size

1.0MB
Sample

221012-sw1y8shdd2
MD5

1215f371365b200adf9626dab1038f36
SHA1

0e8f428306834152242b43a3e6736fea50eb73ab
SHA256

12a0ce43670ef1671689d0abc53412d25c5e5494e6a04e1c1cbb5b88766c1921
SHA512

9dc0644be5b7a390a3e811aff9f3f30d11322cd78219e8354567e967e4b94055b419af038e920dbfc82d790bb36b4428907832c9c259f00aaf8eb1e580bfb945
SSDEEP

24576:TkxmZs+mbukcwAZNVyy6+apbTm1+zEghD6y:TkxuOb5A/YJf4mxhD6y

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/gj10/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  12a0ce43670ef1671689d0abc53412d25c5e5494e6a04e1c1cbb5b88766c1921
- Size
  
  1.0MB
- MD5
  
  1215f371365b200adf9626dab1038f36
- SHA1
  
  0e8f428306834152242b43a3e6736fea50eb73ab
- SHA256
  
  12a0ce43670ef1671689d0abc53412d25c5e5494e6a04e1c1cbb5b88766c1921
- SHA512
  
  9dc0644be5b7a390a3e811aff9f3f30d11322cd78219e8354567e967e4b94055b419af038e920dbfc82d790bb36b4428907832c9c259f00aaf8eb1e580bfb945
- SSDEEP
  
  24576:TkxmZs+mbukcwAZNVyy6+apbTm1+zEghD6y:TkxuOb5A/YJf4mxhD6y
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2