lokibot

General

Target
TNT _AWB+#5505695695095.exe
Size 608KB
Sample230526-ga56aaea22
SHA256 d645c82038ed0caed9dfb2b13d0057e75205e4dfcfb448ebb7b7c6e2271e6079
MD5 d391fe12d6cc21e68a2ae838269e9d27
SHA1 8eb6268f312ea356f26a569330a5adf314fb0a90
SHA512 bb0a9912076f04159fc1d78b20d04b694d66cc1f5d0a3f833a495c6738df0645200384d3bac57895d53306a7192c49b99e71771fe0f952bf5dcdcc00543d55f1
SSDEEP 12288:+7z5GoJiGaq5au6rIWzdBrnPwf4l2U56sKPmNLOlumcHq:45GoR5a6i56zPmNLOyHq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://161.35.102.56/~nikol/?p=143606594
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  TNT _AWB+#5505695695095.exe
- Size 608KB
- SHA256 d645c82038ed0caed9dfb2b13d0057e75205e4dfcfb448ebb7b7c6e2271e6079
- MD5 d391fe12d6cc21e68a2ae838269e9d27
- SHA1 8eb6268f312ea356f26a569330a5adf314fb0a90
- SHA512 bb0a9912076f04159fc1d78b20d04b694d66cc1f5d0a3f833a495c6738df0645200384d3bac57895d53306a7192c49b99e71771fe0f952bf5dcdcc00543d55f1
- SSDEEP 12288:+7z5GoJiGaq5au6rIWzdBrnPwf4l2U56sKPmNLOlumcHq:45GoR5a6i56zPmNLOyHq
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2