lokibot | 0d98a179bd6affe49d2aede0bb1db2709c1a0419f6c51dd79867974744bc7c44 | Triage

Sharing

General

Target

0d98a179bd6affe49d2aede0bb1db2709c1a0419f6c51dd79867974744bc7c44
Size

723KB
Sample

230207-l72ataeb8s
MD5

40666fd3604c7b342b2afcdbc1e0730c
SHA1

3e5c0ffe42c98213996834019be65e9c107e9387
SHA256

0d98a179bd6affe49d2aede0bb1db2709c1a0419f6c51dd79867974744bc7c44
SHA512

c22369380ebbca65cb7248a62eeb8c5549e89145a6c7a94af929a250d02e3f064b77ccdbf57ac88407f3f0163d59d7a336feafafb4cdf85dc57ef2ea0ad4b36f
SSDEEP

12288:o/awHRr/CB06KuLp93bv6IAkMZQHvidfW14OJK7FrO/2obDDlG:o/awxO5dIZZQ2ezA0/9Z

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.147/kelly/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  0d98a179bd6affe49d2aede0bb1db2709c1a0419f6c51dd79867974744bc7c44
- Size
  
  723KB
- MD5
  
  40666fd3604c7b342b2afcdbc1e0730c
- SHA1
  
  3e5c0ffe42c98213996834019be65e9c107e9387
- SHA256
  
  0d98a179bd6affe49d2aede0bb1db2709c1a0419f6c51dd79867974744bc7c44
- SHA512
  
  c22369380ebbca65cb7248a62eeb8c5549e89145a6c7a94af929a250d02e3f064b77ccdbf57ac88407f3f0163d59d7a336feafafb4cdf85dc57ef2ea0ad4b36f
- SSDEEP
  
  12288:o/awHRr/CB06KuLp93bv6IAkMZQHvidfW14OJK7FrO/2obDDlG:o/awxO5dIZZQ2ezA0/9Z
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

lokibotcollectionspywarestealertrojan