lokibot

General

Target
SecuriteInfo.com.Trojan.PackedNET.1662.6530.16721.exe
Size 527KB
Sample221111-km5xtsagg5
SHA256 0abf0757b2efb2c9efff44fa9e7dcd9277d2c9c05ca58ed8231f51f605df1018
MD5 23e41695d65c57fdacb2eebd32ae701d
SHA1 6a9534ce0660d5ad040c2a1f6a4bf650c998c32c
SHA512 c01a4d77f5c4a6880a4dba41e917634065842488972c8ac8b1d94b63275203517fde2a96c9c3aaae6521edd604899a7bcf27a15265946965ef4895e6eedf1b72
SSDEEP 12288:YsCB1OBiX/WRqBFdNnjNNIK9rMAw+pshA4rIf3p3SRrtCH0CBCLZiVi:liOqdhJeK9PW3If3cR40sCLZic
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://208.67.105.148/maersk/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  SecuriteInfo.com.Trojan.PackedNET.1662.6530.16721.exe
- Size 527KB
- SHA256 0abf0757b2efb2c9efff44fa9e7dcd9277d2c9c05ca58ed8231f51f605df1018
- MD5 23e41695d65c57fdacb2eebd32ae701d
- SHA1 6a9534ce0660d5ad040c2a1f6a4bf650c998c32c
- SHA512 c01a4d77f5c4a6880a4dba41e917634065842488972c8ac8b1d94b63275203517fde2a96c9c3aaae6521edd604899a7bcf27a15265946965ef4895e6eedf1b72
- SSDEEP 12288:YsCB1OBiX/WRqBFdNnjNNIK9rMAw+pshA4rIf3p3SRrtCH0CBCLZiVi:liOqdhJeK9PW3If3cR40sCLZic
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2