lokibot

General

Target

Quotationinmay2023.docx
Size

10KB
Sample

230507-k778pafe3z
MD5

4267eaf046110e4d7670e53ccb81ecf4
SHA1

3f3ad83b346680ec7f9cb8a40a387b4ecfe46fbf
SHA256

9ea03e4c08f50db0da65d80325a9aafc79749d74b0960ae3fc435ab1541462e5
SHA512

19289dbc853135da0546aada0e0943fe52299770ed29eee8d8129bffed772f08d379ceca7a07eff4192f90b086fc205c1cdcc8dff6274e57c4db62316d4d87da
SSDEEP

192:ScIMmtPYqPC7UpG/bkpbJNOs6rdlJFtGxV3QAw+:SPXgqPCfIJNOHjJFtGxxQAb

Score

10^/10

Malware Config

Extracted

Rule

Microsoft Office WebSettings Relationship

C2

http://%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23EERJEJTRJTJJTJERT0R09ERT90RE9T0FGFDFG0DGDFWJHHSDJFHJDFJSFJHJ@1412838044/x/i/%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23.doc

Extracted

Family

lokibot

C2

http://171.22.30.164/mancho/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  Quotationinmay2023.docx
- Size
  
  10KB
- MD5
  
  4267eaf046110e4d7670e53ccb81ecf4
- SHA1
  
  3f3ad83b346680ec7f9cb8a40a387b4ecfe46fbf
- SHA256
  
  9ea03e4c08f50db0da65d80325a9aafc79749d74b0960ae3fc435ab1541462e5
- SHA512
  
  19289dbc853135da0546aada0e0943fe52299770ed29eee8d8129bffed772f08d379ceca7a07eff4192f90b086fc205c1cdcc8dff6274e57c4db62316d4d87da
- SSDEEP
  
  192:ScIMmtPYqPC7UpG/bkpbJNOs6rdlJFtGxV3QAw+:SPXgqPCfIJNOHjJFtGxxQAb
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Blocklisted process makes network request
- Downloads MZ/PE file
- Abuses OpenXML format to download file from external location
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook profiles
  collection
behavioral1 behavioral2