lokibot

General

Target
750baeb260060e51e2f3135c90a0c933.exe
Size 845KB
Sample230222-rcplesca34
SHA256 e2d80721df3ecf8069151a8bded0dcf3aa1f063b162182c1dbd40fe06459c4de
MD5 750baeb260060e51e2f3135c90a0c933
SHA1 ce5343bed146b6cea9a88fd455fc3af3b99f5b03
SHA512 f3902ed2ee0df9d129bc081045708bca9ab29a12f42a339f692bb9a9f87095662bac9e9e672e7d8eec253614b752ca8f37da8f5be0d7a1d6c86556b55a9d1d1b
SSDEEP 24576:+VL5gAh8vsAGHmWlQswz69le3x4Dv1ls/omSjMEjeRCtcu:+VL5gAeAmvqe3I65Eje
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.164/kung/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  750baeb260060e51e2f3135c90a0c933.exe
- Size 845KB
- SHA256 e2d80721df3ecf8069151a8bded0dcf3aa1f063b162182c1dbd40fe06459c4de
- MD5 750baeb260060e51e2f3135c90a0c933
- SHA1 ce5343bed146b6cea9a88fd455fc3af3b99f5b03
- SHA512 f3902ed2ee0df9d129bc081045708bca9ab29a12f42a339f692bb9a9f87095662bac9e9e672e7d8eec253614b752ca8f37da8f5be0d7a1d6c86556b55a9d1d1b
- SSDEEP 24576:+VL5gAh8vsAGHmWlQswz69le3x4Dv1ls/omSjMEjeRCtcu:+VL5gAeAmvqe3I65Eje
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2