lokibot | afffa10e1f2d23ac3177cc69a490ddcec88d2a3df3cd2b037a4e6e0ec0e51285 | Triage

Sharing

General

Target

afffa10e1f2d23ac3177cc69a490ddcec88d2a3df3cd2b037a4e6e0ec0e51285
Size

889KB
Sample

230208-xtbnsadh7y
MD5

195897114628c863f372b3d6ce3e7cd8
SHA1

9bf0beae1218d717447e5d69f5bb29deece86ae7
SHA256

afffa10e1f2d23ac3177cc69a490ddcec88d2a3df3cd2b037a4e6e0ec0e51285
SHA512

139ee573b80d97cfdffce7454ca2bfc40b126fbd9a1ac047f66aa54a4f1170d1f3b424ae5b24ff06f8ef30e53fcd293fdd94da266e619e1c36020367545a5330
SSDEEP

12288:Te2iNZrgzTTGhgzTbAp5CiLo20qLrMVYCb5LEkOFl3V8WhXjLP4M/Qe0iI0f:C1bgzPGhgzfYtXyNlgjFDzLwMYej

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.147/line/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  afffa10e1f2d23ac3177cc69a490ddcec88d2a3df3cd2b037a4e6e0ec0e51285
- Size
  
  889KB
- MD5
  
  195897114628c863f372b3d6ce3e7cd8
- SHA1
  
  9bf0beae1218d717447e5d69f5bb29deece86ae7
- SHA256
  
  afffa10e1f2d23ac3177cc69a490ddcec88d2a3df3cd2b037a4e6e0ec0e51285
- SHA512
  
  139ee573b80d97cfdffce7454ca2bfc40b126fbd9a1ac047f66aa54a4f1170d1f3b424ae5b24ff06f8ef30e53fcd293fdd94da266e619e1c36020367545a5330
- SSDEEP
  
  12288:Te2iNZrgzTTGhgzTbAp5CiLo20qLrMVYCb5LEkOFl3V8WhXjLP4M/Qe0iI0f:C1bgzPGhgzfYtXyNlgjFDzLwMYej
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

lokibotcollectionspywarestealertrojan