lokibot

General

Target
SecuriteInfo.com.Trojan.Packed2.42633.6518.31699.exe
Size 613KB
Sample221115-2rnb1sgc97
SHA256 4c1e1e6f491e2df8ea3185d3f7f3a5387a7893270e46f1e0ff0b2d8be9f09a62
MD5 31e4d7a4d2e866a606458dc54f2805e1
SHA1 10fd7272876cb5ff6eee92e2dd6cf102fff26242
SHA512 1eb6ffcc4c0436ea8a8e22f5e5a179a6dbd2ec160ea856003377e428d9126cc88c5a06436fd6d45a6fde9cd69cd43ead8511a99c9bbac5c65eb5df0205227f07
SSDEEP 6144:cB4XgobpFIkb3ysE78ed14CE/x0zvvO7E9HRz6C8lIsm+uUPa4fP9j3Y+/F/qugO:cB4XJ4lSBEX6GihPa435ombgcpCYrNF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.147/line/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  SecuriteInfo.com.Trojan.Packed2.42633.6518.31699.exe
- Size 613KB
- SHA256 4c1e1e6f491e2df8ea3185d3f7f3a5387a7893270e46f1e0ff0b2d8be9f09a62
- MD5 31e4d7a4d2e866a606458dc54f2805e1
- SHA1 10fd7272876cb5ff6eee92e2dd6cf102fff26242
- SHA512 1eb6ffcc4c0436ea8a8e22f5e5a179a6dbd2ec160ea856003377e428d9126cc88c5a06436fd6d45a6fde9cd69cd43ead8511a99c9bbac5c65eb5df0205227f07
- SSDEEP 6144:cB4XgobpFIkb3ysE78ed14CE/x0zvvO7E9HRz6C8lIsm+uUPa4fP9j3Y+/F/qugO:cB4XJ4lSBEX6GihPa435ombgcpCYrNF
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2