lokibot | cdb15e908576d5b6d32f04746948439e032d54eede7f9b318eb95b1341abf7c3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Bonifico_Riepilogo operazione_0122276_pdf.iso
Size

278KB
Sample

221201-l9ppssha68
MD5

7a375aec2a04b79e55fb8a2b5ae787c7
SHA1

56e6d5f27cc54db5fefc56c0476edca00e680579
SHA256

cdb15e908576d5b6d32f04746948439e032d54eede7f9b318eb95b1341abf7c3
SHA512

88b86889b4d4021e1e423164c32fcf74ceb95fcd315bf2bc75f07039caace9e10a135a4b2b7bd7ad7a9be4b25132b51d8ffe4aa6a07b8b4d7915c46e5b66d3da
SSDEEP

3072:rK/iFmwolmY6W0f1jBq7fMIFDElD1z/vh0gG5+jdZJCtcwzZ:G/iWlS5tFqzBE91tFHw

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

https://julypc.ml/PWS/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  Bonifico_Riepilogo operazione_0122276_pdf.exe
- Size
  
  217KB
- MD5
  
  7eabd689be0532e41c8660ca3d7fc9e5
- SHA1
  
  75bad07bdcc0a2cb65670f57f23a92bf442144e8
- SHA256
  
  b6414f29e6a15ad46af0137506063f692213228b583df5e291e4a8cb0ebca1db
- SHA512
  
  fedb0955d52757e725a27cc1337348c2d9a508ee81ccc529692524e604a79bb096ba1754a3a0f07c8e585edf17af7f6812d6ed6e3a1adc1df71dfac398c69bd4
- SSDEEP
  
  3072:sK/iFmwolmY6W0f1jBq7fMIFDElD1z/vh0gG5+jdZJCtcwzZ:F/iWlS5tFqzBE91tFHw
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

lokibotcollectionspywarestealertrojan

behavioral2

lokibotcollectionspywarestealertrojan