lokibot

General

Target

d68fe72481bca1f576690b86831818b7.bin
Size

180KB
Sample

230117-jn7x5sgd41
MD5

80ff0fc5060e77578a0600ed29b0aa98
SHA1

72511594d932c53200d53ae80c16b0d540117fe7
SHA256

c100e2bc81d204a712b0d1e6e3aff14c4b0df2a860a61bbc05e0d712f17b9b1f
SHA512

2585b18499c5bf9a5ac1ff66d0f6f28f0374027de4034a9b3404899883eb6700d9d5bb46af0c51261723718fe4a4b63b9959e321f7abf9c0acbd688f03565efc
SSDEEP

3072:6WdenW5Vl3tF9Fz4XfjIsosII/viuKWJOZQLiNhU8TbBQyCLKnJM8sjT:l9PJ5Fz8jI2f/KuKcOlNyk7CLKrsT

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://ab-services.ma/COPYRIGHT/img/mensch/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  98a45a687d6c66a51e8d07a74a62dcba566c5df2a5c44d8cdf97cf14dfc6b3c0.exe
- Size
  
  444KB
- MD5
  
  d68fe72481bca1f576690b86831818b7
- SHA1
  
  d77ae858864788f184bdb92642728fed4e36eda0
- SHA256
  
  98a45a687d6c66a51e8d07a74a62dcba566c5df2a5c44d8cdf97cf14dfc6b3c0
- SHA512
  
  c091d56d8fa735bd29f09b06abf61bda57ca85cf536b2913a6186c4bd3a088e92f06b7bec6f8169618808ba29635cda6d3bfcd93fcfc0ec7543f9df1ac069dd2
- SSDEEP
  
  3072:7ig4RkLpN8FatnSINJIerSlUWIg+82l9P0U/z7UtdIpDFA/0Se+0fPc4XiX4mcR4:7ig4RE/8qSoJvSl7an0GktED1+0fkQ
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2