lokibot

General

Target
Shipment Document BL,INV and packing list.jpg.ace
Size 489KB
Sample230719-k964eaaf66
SHA256 b6522f4aa1002a1c75f0c2b16b53f6e948adee0a7fdd05eded6bed2d55235ad2
MD5 4cb0f0394cd2fa1a0b4d65b49de36b63
SHA1 095eb6c85d2618950e38571f3c1cfba4952783e7
SHA512 1dfe13c4119752971ccb7fcfeae0dd36fb94182a4fbdf663352ba038e25f3c74e5048449f49138b2fd46d9a16a569694af3c142e0697d3d0d7302997d854a93e
SSDEEP 12288:2XjbqQKTqPDZqBBr8T9G4+bhB6OPbEP6BnmUeTKcA4q8O:2iQKTqbgfYpC9BvPSELcAF8O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://138.68.56.139/?p=13459621
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  Shipment Document BL,INV and packing list.jpg.exe
- Size 561KB
- SHA256 2e0d0762433ff21184bb4e8330db8fa104958537fad81fb39d8e3e7d849ee9f8
- MD5 5e4d39e60ff35813b11c0f7875c87d38
- SHA1 b7664d8f8182e736a3cf4509c5a38fb1c17a7fad
- SHA512 6459b4de8cc328e8b124d9f220a8d695e239c7a974a75909ddee513e1b8979bb4852bf351911ba1c1cc3219210e4a4116cf3ba6977fedd326c4db6f6b1364a5c
- SSDEEP 12288:trFfAdymAY2kcdbL4EfMRD9QMKOXSehTZk1lhlcGifGL6fq0:bfoN6GEfMRhKASehTC1lgyW
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2