lokibot

General

Target
J9ZBELVRSGfaYOu.exe
Size 711KB
Sample230615-3wpw3sbf6z
SHA256 b4cf7c6df77b6b4de0f687772bebf0add392ec60f709b68146e0d05eb104b077
MD5 f1209331e6475bad1f92b914634bd0ce
SHA1 8c484c62919454c2b2df81bb7bce720939de6363
SHA512 f5f26fa9de5b507b2fed75e2c8f4e9ac54eb94787dee814e47df9b15740659dcbe6b46437a6c4ceec1959b576306d858bad56373bc41457e484657ca8e5472ab
SSDEEP 12288:IoAcuF6mn1DHLZnvJCciOe42KMu/N3mWhQmwmJCMpU6e3DptPJDRtkvs1ywRwhou:WiOV/NOahoDrJD7WKywChogfY5wJBZyK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://161.35.102.56/~nikol/?p=27226656008
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  J9ZBELVRSGfaYOu.exe
- Size 711KB
- SHA256 b4cf7c6df77b6b4de0f687772bebf0add392ec60f709b68146e0d05eb104b077
- MD5 f1209331e6475bad1f92b914634bd0ce
- SHA1 8c484c62919454c2b2df81bb7bce720939de6363
- SHA512 f5f26fa9de5b507b2fed75e2c8f4e9ac54eb94787dee814e47df9b15740659dcbe6b46437a6c4ceec1959b576306d858bad56373bc41457e484657ca8e5472ab
- SSDEEP 12288:IoAcuF6mn1DHLZnvJCciOe42KMu/N3mWhQmwmJCMpU6e3DptPJDRtkvs1ywRwhou:WiOV/NOahoDrJD7WKywChogfY5wJBZyK
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2