lokibot

General

Target

c99108cc3bdd92990823a1606d594037.bin
Size

511KB
Sample

230526-b5fk8adc84
MD5

abddad87b6f0ff29ae6e024b919e684c
SHA1

e8bfe39af7211d08e4c8002ffd9ccf27b1f90569
SHA256

3610739beae4669713652e06e8d4cdaaff4b1535f4b3f91c5a7b6435e083ab32
SHA512

257041808ca0ee331b4032094b741d529acaeaddf82886b93e44bcb706c8ecfa3b651bf33b14d3336fea2a5ca81129a1ff299a2e5d8e2f7b161fa89a8af8aeca
SSDEEP

12288:wgN41kBMqEg3RR32Hl7AyEApw79AxyzOPTmwyWSrGb:wgN5xw7FzW7+xyzOrPiGb

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.164/fred1/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  2da6801a33c467753ac2944cf1b5e1dcb2396935e4f8eb057c0319e98b1ad23c.exe
- Size
  
  554KB
- MD5
  
  c99108cc3bdd92990823a1606d594037
- SHA1
  
  8a8739d405335be37758d5c2df2bb92a7b56dc6c
- SHA256
  
  2da6801a33c467753ac2944cf1b5e1dcb2396935e4f8eb057c0319e98b1ad23c
- SHA512
  
  444f11671e798e72b25b2ad173716e24f53785fbea7d4ac5b8becefa6087b80aa5871a206f5b606e5c31d4fbd1414b0eb2d7e2944b873648069216ac0a45ce22
- SSDEEP
  
  12288:l5tPplTY6RhKu45Z+GzH/7eaJZ2kWIVki2rdEA2:l5JTDEJZRH6a/WAu+9
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2