lokibot | 99e69a797b5bc14f55127bc7100aabb37683008fd89043a116c83f5255a1e6d1 | Triage

Sharing

General

Target

99e69a797b5bc14f55127bc7100aabb37683008fd89043a116c83f5255a1e6d1
Size

705KB
Sample

230206-l18rbadd23
MD5

40ea3a0c428397cc2feb2675cc37150c
SHA1

8b1a787ff8c044e5503139ceef1b68d68cff1f89
SHA256

99e69a797b5bc14f55127bc7100aabb37683008fd89043a116c83f5255a1e6d1
SHA512

ca903e627047cd8321acebfdd0f1227dd59e6e42361897936b05d2ba443d15c0176f3360d4cd47eb395947a932dcfc642a48ccc877b2eb0fc6b400123e5e9b3b
SSDEEP

12288:QpkNPA7cXnyXx6q16ahRZ5G1MQZAbRIgY5NiTisiS8fHXYvlC:pA71NMS5G1MQZAbRI35ATisizHXY

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.147/line/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  99e69a797b5bc14f55127bc7100aabb37683008fd89043a116c83f5255a1e6d1
- Size
  
  705KB
- MD5
  
  40ea3a0c428397cc2feb2675cc37150c
- SHA1
  
  8b1a787ff8c044e5503139ceef1b68d68cff1f89
- SHA256
  
  99e69a797b5bc14f55127bc7100aabb37683008fd89043a116c83f5255a1e6d1
- SHA512
  
  ca903e627047cd8321acebfdd0f1227dd59e6e42361897936b05d2ba443d15c0176f3360d4cd47eb395947a932dcfc642a48ccc877b2eb0fc6b400123e5e9b3b
- SSDEEP
  
  12288:QpkNPA7cXnyXx6q16ahRZ5G1MQZAbRIgY5NiTisiS8fHXYvlC:pA71NMS5G1MQZAbRI35ATisizHXY
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

lokibotcollectionspywarestealertrojan