lokibot

General

Target

Payment Advice -0009000012900093 -pdf.exe
Size

812KB
Sample

230202-p5x26agd38
MD5

8bc6ac8a482e0ec67fdbba6c3471c0af
SHA1

e43fa55a91c8392ca547b010238270f8895292d3
SHA256

a407c255a2db0f10f4e06f1fae936a0f07b18401d824e7454bca9f0a132f3e01
SHA512

61d2a745e57b2f4feb915903fe0bc0d484202b0d9c04b2ffede1b0fe47adc7c42f451e658f4c60b3a2a3448f87889d67c7acf7b0303e8de235f62bc8c1e3c971
SSDEEP

24576:hX4+B6F0x3PjV122LcGtnEFuZ6xpqG4yPa:x8WtR126jtCuZ6xq

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.147/health2/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  Payment Advice -0009000012900093 -pdf.exe
- Size
  
  812KB
- MD5
  
  8bc6ac8a482e0ec67fdbba6c3471c0af
- SHA1
  
  e43fa55a91c8392ca547b010238270f8895292d3
- SHA256
  
  a407c255a2db0f10f4e06f1fae936a0f07b18401d824e7454bca9f0a132f3e01
- SHA512
  
  61d2a745e57b2f4feb915903fe0bc0d484202b0d9c04b2ffede1b0fe47adc7c42f451e658f4c60b3a2a3448f87889d67c7acf7b0303e8de235f62bc8c1e3c971
- SSDEEP
  
  24576:hX4+B6F0x3PjV122LcGtnEFuZ6xpqG4yPa:x8WtR126jtCuZ6xq
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2