lokibot | 85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77 | Triage

Sharing

General

Target

85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77
Size

613KB
Sample

221124-j46p1sdg2t
MD5

0a5df7794f57bbada65ccdb4025d562c
SHA1

0271540ff15479122cdbe37efe9ddb778416a9b8
SHA256

85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77
SHA512

5301dca1620f4c4082551cf0cb475325721b18a391c9a2ef291cde29f7943d8e354ebc1088c2b76f8114272762d6f39d5435b1f08c4cc4023877dabe643d98aa
SSDEEP

12288:7iVgh/PsZ1DX/VDJGl8z4Zq/zi22d5qh4IWuVAeHx:GVgh/PJyUq/z+s4I

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/gl16/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77
- Size
  
  613KB
- MD5
  
  0a5df7794f57bbada65ccdb4025d562c
- SHA1
  
  0271540ff15479122cdbe37efe9ddb778416a9b8
- SHA256
  
  85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77
- SHA512
  
  5301dca1620f4c4082551cf0cb475325721b18a391c9a2ef291cde29f7943d8e354ebc1088c2b76f8114272762d6f39d5435b1f08c4cc4023877dabe643d98aa
- SSDEEP
  
  12288:7iVgh/PsZ1DX/VDJGl8z4Zq/zi22d5qh4IWuVAeHx:GVgh/PJyUq/z+s4I
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

lokibotcollectionspywarestealertrojan