lokibot

General

Target

b11ba73cc918595cef15c54a151c823fdf597f8681ee486a21f2e83ae1f7e52d
Size

894KB
Sample

230129-1wkagsed86
MD5

0874baecefc1303596be78cc68453c54
SHA1

9b27f4e87b858ba7bfc4bd12dc95d57558824d9a
SHA256

b11ba73cc918595cef15c54a151c823fdf597f8681ee486a21f2e83ae1f7e52d
SHA512

0e7f964dddcf242f4502b39aad4455692197aca2996ddb82e08a48456397bc4806b661fcec41b6bd32927d45c96dd41a33bdf782795bf2f894f37efd4a418b5c
SSDEEP

12288:2YV6MorX7qzuC3QHO9FQVHPF51jgcL5V3jBWhHVusACuWdaot4j7TWrrkQ4Jd31S:1BXu9HGaVHbTAhHiCxdaoJkXJMX1

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://no2endr.xyz/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  b11ba73cc918595cef15c54a151c823fdf597f8681ee486a21f2e83ae1f7e52d
- Size
  
  894KB
- MD5
  
  0874baecefc1303596be78cc68453c54
- SHA1
  
  9b27f4e87b858ba7bfc4bd12dc95d57558824d9a
- SHA256
  
  b11ba73cc918595cef15c54a151c823fdf597f8681ee486a21f2e83ae1f7e52d
- SHA512
  
  0e7f964dddcf242f4502b39aad4455692197aca2996ddb82e08a48456397bc4806b661fcec41b6bd32927d45c96dd41a33bdf782795bf2f894f37efd4a418b5c
- SSDEEP
  
  12288:2YV6MorX7qzuC3QHO9FQVHPF51jgcL5V3jBWhHVusACuWdaot4j7TWrrkQ4Jd31S:1BXu9HGaVHbTAhHiCxdaoJkXJMX1
Score

10^/10

upx lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

UPX packed file

Drops startup file

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2