lokibot

General

Target
MAESTRO_BANKSLIP_BWE0623.pdf.exe
Size 656KB
Sample230710-nvk46saa68
SHA256 65acc93f4a502f7efbe10313ed41bc436425ebe172f3974883f0ecb6d2ecbf3c
MD5 aa3160f77c0d83e7aa1f37fe0af3d739
SHA1 f312f90b4c2b7fe44711c3ae9d16a79c1528c218
SHA512 aefc933420b194331ea1452cdce10066ceceeef7a73fe74e20dd832aa7855e916a6e3822501c25571542dc86786bc73c04508e3d6b854ed8b2e65846864a7c06
SSDEEP 12288:jJ4a5p7tL+NBegud+kAP0yVB7RfrGvmzffFKoQNv3GQZti+0:hp5+eJkjVB7Zum0Hvbtg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.164/fresh1/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  MAESTRO_BANKSLIP_BWE0623.pdf.exe
- Size 656KB
- SHA256 65acc93f4a502f7efbe10313ed41bc436425ebe172f3974883f0ecb6d2ecbf3c
- MD5 aa3160f77c0d83e7aa1f37fe0af3d739
- SHA1 f312f90b4c2b7fe44711c3ae9d16a79c1528c218
- SHA512 aefc933420b194331ea1452cdce10066ceceeef7a73fe74e20dd832aa7855e916a6e3822501c25571542dc86786bc73c04508e3d6b854ed8b2e65846864a7c06
- SSDEEP 12288:jJ4a5p7tL+NBegud+kAP0yVB7RfrGvmzffFKoQNv3GQZti+0:hp5+eJkjVB7Zum0Hvbtg
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2