lokibot

General

Target
691533800613bff43f0e1845240bd42e.exe
Size 608KB
Sample230526-c75tkade37
SHA256 d9b8816dc05c98d38419c94b02dc18ebd9494d13088ca2e1bb757f987001c1fd
MD5 691533800613bff43f0e1845240bd42e
SHA1 a2f3022e07ecb00f7bef58239868e4b790c28004
SHA512 29f26291f2ab84cc3052fd17c9db33ae5a5193b86b73f56a75b8b731662557d69446b8494ca1da942dc9d712b53947f519508c68dfee6c9bff78e2d86bc72c1c
SSDEEP 12288:J7z5GoJiGaq5au9oObPfupQyWfANjRKirVjboOZ9FggZ9+N70HraGf:l5GoR5am1PWp0fANjPrhoOZ9FgguN70h
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://185.246.220.85/fresh/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  691533800613bff43f0e1845240bd42e.exe
- Size 608KB
- SHA256 d9b8816dc05c98d38419c94b02dc18ebd9494d13088ca2e1bb757f987001c1fd
- MD5 691533800613bff43f0e1845240bd42e
- SHA1 a2f3022e07ecb00f7bef58239868e4b790c28004
- SHA512 29f26291f2ab84cc3052fd17c9db33ae5a5193b86b73f56a75b8b731662557d69446b8494ca1da942dc9d712b53947f519508c68dfee6c9bff78e2d86bc72c1c
- SSDEEP 12288:J7z5GoJiGaq5au9oObPfupQyWfANjRKirVjboOZ9FggZ9+N70HraGf:l5GoR5am1PWp0fANjPrhoOZ9FgguN70h
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2