lokibot

General

Target
FedEx Express _771706182561.exe
Size 482KB
Sample230414-gslvcsaa2t
SHA256 3a7511034e72aa8874f3763cb01604464c74571237bc08906578ed9dcf2c137f
MD5 4c45a31290406e2a67c52983c94e5b38
SHA1 98fa0182fd6594b4b65c3414f8ee67691cbf3e36
SHA512 2b825435170105ff73744bd3ff2b46c0ebcbc5f84b0e74fa3711d5a86d1d84953623023b514e6cf7074d5aa81d99d46ff220983cf1de306528d2aaa77c147b97
SSDEEP 12288:MPXf1Gn5nqNUytgblL5nvjunSKlsZ3IlL:qf1MnfVlFvqTlRd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://64.227.48.212/?page_id=6303
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  FedEx Express _771706182561.exe
- Size 482KB
- SHA256 3a7511034e72aa8874f3763cb01604464c74571237bc08906578ed9dcf2c137f
- MD5 4c45a31290406e2a67c52983c94e5b38
- SHA1 98fa0182fd6594b4b65c3414f8ee67691cbf3e36
- SHA512 2b825435170105ff73744bd3ff2b46c0ebcbc5f84b0e74fa3711d5a86d1d84953623023b514e6cf7074d5aa81d99d46ff220983cf1de306528d2aaa77c147b97
- SSDEEP 12288:MPXf1Gn5nqNUytgblL5nvjunSKlsZ3IlL:qf1MnfVlFvqTlRd
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2