lokibot

General

Target
DHL Express Receipt_AWB8114704840778.exe
Size 479KB
Sample230508-kd7p3abe41
SHA256 e4a9cb185c46bf812bf29890c14a2f20f6dbddfc1e34abe5e15af668077b33f6
MD5 f626431f611e7bf564ee104f9089b289
SHA1 228c6ae8425a04eaa8ff8eb1e77ad6a34ad2f857
SHA512 519a3eecc1b02cd926bcaa3c82723fa8e495713432c1a46ee43cd1cbb96ceec7f3a5a8d78f2f3db4b3d91a6d181d7222ac6b8c7564214ed0d27aa2c61dc71a9d
SSDEEP 12288:LMcwMEpSb0SCRduBdnoLtO0cePDy980T0VLjb8WncM:L7wM2S0RIboLtYePmXT0ZbTc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://104.156.227.195/~blog/?p=1904203
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  DHL Express Receipt_AWB8114704840778.exe
- Size 479KB
- SHA256 e4a9cb185c46bf812bf29890c14a2f20f6dbddfc1e34abe5e15af668077b33f6
- MD5 f626431f611e7bf564ee104f9089b289
- SHA1 228c6ae8425a04eaa8ff8eb1e77ad6a34ad2f857
- SHA512 519a3eecc1b02cd926bcaa3c82723fa8e495713432c1a46ee43cd1cbb96ceec7f3a5a8d78f2f3db4b3d91a6d181d7222ac6b8c7564214ed0d27aa2c61dc71a9d
- SSDEEP 12288:LMcwMEpSb0SCRduBdnoLtO0cePDy980T0VLjb8WncM:L7wM2S0RIboLtYePmXT0ZbTc
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2