lokibot

General

Target
A01_Shipment doc _for_ASL H1209.zip
Size 438KB
Sample230717-k568lsba64
SHA256 359b7dca0b14c952c35a570272b3d9c3a9d6aa7eaebbbf8cd6a26413f09d20d0
MD5 e15f81de38c4a82994abbed275f8496e
SHA1 32fda8c328bdc0c6939cebce82112af7d1ab5b71
SHA512 392bb6d21cd55a9e3d338f4574695ba736bec9d4557f7b583579af61016f8385eb6530a050b787240ad5f2e4dc03cc4ba62b771c503e40f31b8217bf74c05e4c
SSDEEP 12288:uGZKGno/OfkWTmG4NoYK7gg2SNBoIcrO8bxbvO:uGZrcekWX42hH2Sr6S4DO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://185.246.220.85/ugopounds/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  A01_Shipment doc _for_ASL H1209.exe
- Size 496KB
- SHA256 dba87425c7eff12d404688728673f64bc6faf6e62cc4b3801ca18a08fc3214a9
- MD5 583e977b5df64ab36d7c9f3b4aac43c8
- SHA1 d648a9a64f171ac7dbf74c3b4246c088115f19a8
- SHA512 b1de5367bae7e2efc2b96c034db6a8d08b6d238a61d083bf75bfef1249d6bc6344e75162c3d0e335f46e067fa4b05b974ad55649ca859e3da6ca22249d89ddfd
- SSDEEP 12288:GqTrQaSejL8ZiVZ++G+LTx7KeFsWuZ9i11oYU9zYkD4s1USAS0kd9ll:GqTrQaSejL8ZiVZI+Px79nq1pzYkD4sT
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2