Overview

overview

10

Static

static

3

loki.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    loki.exe

  • Size

    917KB

  • Sample

    230524-yehn8aef36

  • MD5

    74a966a9a8bf3ed3ae9e8ee485f7f52b

  • SHA1

    7078e8caa0131608d9e6e9fbdc322a09a640b33e

  • SHA256

    8e6cde38df37ec19a97ac003f47a15629fb425b19ed6e869f108512555fc4f95

  • SHA512

    11aa91031fce05c2dd2905bfd01d3a85d2d2b322b6243f4e496eff3d7254713972bc5e306abef584a8ca14dfc58b7c51901ecce272d92f94d5b4207eb335756a

  • SSDEEP

    12288:NBt1C0xPma82bf232IQnF2Qq6jQwawDNQnTOc/Hou5:NM0xuaLTedS2ojQ/wxiOcPo

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://185.246.220.85/blair/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      loki.exe

    • Size

      917KB

    • MD5

      74a966a9a8bf3ed3ae9e8ee485f7f52b

    • SHA1

      7078e8caa0131608d9e6e9fbdc322a09a640b33e

    • SHA256

      8e6cde38df37ec19a97ac003f47a15629fb425b19ed6e869f108512555fc4f95

    • SHA512

      11aa91031fce05c2dd2905bfd01d3a85d2d2b322b6243f4e496eff3d7254713972bc5e306abef584a8ca14dfc58b7c51901ecce272d92f94d5b4207eb335756a

    • SSDEEP

      12288:NBt1C0xPma82bf232IQnF2Qq6jQwawDNQnTOc/Hou5:NM0xuaLTedS2ojQ/wxiOcPo

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks