lokibot | 8c61d61c9162a6735ceb53e4109851feacfb05f2dee42ead799680cf874ec903 | Triage

Sharing

General

Target

8c61d61c9162a6735ceb53e4109851feacfb05f2dee42ead799680cf874ec903
Size

313KB
Sample

230208-xtbc1seg23
MD5

b9d2a12dec8e6f3d7a5260c6259aa639
SHA1

3c5fd96f26116d68c46219c15e04b56916f312b3
SHA256

8c61d61c9162a6735ceb53e4109851feacfb05f2dee42ead799680cf874ec903
SHA512

45ff4a8e150135fca7be5c120bda7f46aad1a59509dcd26220bac9b9fb70e0efb69974d5aa6a0d29dc25aaaf7bbbde8618b4ba45585aff43b586b733256e4280
SSDEEP

3072:Owrqo6l/yXR5b71vA1YUnIxNjPJwaPAj51QtmhDlLnWByUAl16CXiE+iBW:Om++HdAvnIxNagAbfDRnWUj6FiI

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.164/kung/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  8c61d61c9162a6735ceb53e4109851feacfb05f2dee42ead799680cf874ec903
- Size
  
  313KB
- MD5
  
  b9d2a12dec8e6f3d7a5260c6259aa639
- SHA1
  
  3c5fd96f26116d68c46219c15e04b56916f312b3
- SHA256
  
  8c61d61c9162a6735ceb53e4109851feacfb05f2dee42ead799680cf874ec903
- SHA512
  
  45ff4a8e150135fca7be5c120bda7f46aad1a59509dcd26220bac9b9fb70e0efb69974d5aa6a0d29dc25aaaf7bbbde8618b4ba45585aff43b586b733256e4280
- SSDEEP
  
  3072:Owrqo6l/yXR5b71vA1YUnIxNjPJwaPAj51QtmhDlLnWByUAl16CXiE+iBW:Om++HdAvnIxNagAbfDRnWUj6FiI
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

lokibotcollectionspywarestealertrojan