lokibot

General

Target

tmp
Size

313KB
Sample

230717-nhkb4sbd76
MD5

3e95261aa13150799f0146b58e080ec7
SHA1

355bf29c3caaf40ad6db0b1c5d9556d5623b34d7
SHA256

367f82b0aa68d1f0949ec9709ecdb4da28e5ef87c41b5de4c2edbad414631a6d
SHA512

d54af4f97a95baa99e174ccc9f65b5cfa429d3f0ae3fd94c59a101945700f5c0d02ec4111ab05ff44565c2f3a244f0a4f6e5fd28ff8e9a64192a11e6b5f5a28b
SSDEEP

3072:/TLAh4yEWMuqJA7pMp77E3Rzr4yGxHe5ybZ7OTiAT:rLAun6Uk6E3Jr4N1Jd7O2AT

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.147/mous/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  tmp
- Size
  
  313KB
- MD5
  
  3e95261aa13150799f0146b58e080ec7
- SHA1
  
  355bf29c3caaf40ad6db0b1c5d9556d5623b34d7
- SHA256
  
  367f82b0aa68d1f0949ec9709ecdb4da28e5ef87c41b5de4c2edbad414631a6d
- SHA512
  
  d54af4f97a95baa99e174ccc9f65b5cfa429d3f0ae3fd94c59a101945700f5c0d02ec4111ab05ff44565c2f3a244f0a4f6e5fd28ff8e9a64192a11e6b5f5a28b
- SSDEEP
  
  3072:/TLAh4yEWMuqJA7pMp77E3Rzr4yGxHe5ybZ7OTiAT:rLAun6Uk6E3Jr4N1Jd7O2AT
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2