lokibot | 04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2

General

Target

04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe
Size

431KB
MD5

eaee5df0875713fd78523ed4fdc30d39
SHA1

e31a30045bfcb92cfc9a80a69bcbe2087078cf0d
SHA256

04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2
SHA512

bf142ec03ee4b671d0333b4c4d1f2f59f7b8a335a61d01da842554a7c6b881d39f784249820403c1ce508e52eefef3e364283cbfa9a740908b0c892253c7c5a1
SSDEEP

6144:j+hiQ1o15sp7QPBTiPqWzD2Kr+dsojcYdKRyMfztIo7xZqpgg4WnU/LBZloAITGZ:y7c1iCFHc1tIwaU/RorHzS352F

Score

10^/10

Family

lokibot

C2

https://sempersim.su/c11/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 3 IoCs

resource	yara_rule
behavioral1/memory/1384-9-0x0000000000080000-0x0000000000122000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1384-10-0x0000000000080000-0x0000000000122000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1384-14-0x0000000000080000-0x0000000000122000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing common artifacts observed in infostealers 3 IoCs

resource	yara_rule
behavioral1/memory/1384-9-0x0000000000080000-0x0000000000122000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral1/memory/1384-10-0x0000000000080000-0x0000000000122000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral1/memory/1384-14-0x0000000000080000-0x0000000000122000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer

Detects executables referencing many file transfer clients. Observed in information stealers 3 IoCs

resource	yara_rule
behavioral1/memory/1384-9-0x0000000000080000-0x0000000000122000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/1384-10-0x0000000000080000-0x0000000000122000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/1384-14-0x0000000000080000-0x0000000000122000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2276 set thread context of 1384	2276	04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe	28

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1384	2276	04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe	28
PID 2276 wrote to memory of 1384	2276	04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe	28
PID 2276 wrote to memory of 1384	2276	04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe	28
PID 2276 wrote to memory of 1384	2276	04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe	28
PID 2276 wrote to memory of 1384	2276	04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe	28
PID 2276 wrote to memory of 1384	2276	04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe	28
PID 2276 wrote to memory of 1384	2276	04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe	28
PID 2276 wrote to memory of 1384	2276	04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe	28
PID 2276 wrote to memory of 1384	2276	04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe	28
PID 2276 wrote to memory of 1384	2276	04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe	28

C:\Users\Admin\AppData\Local\Temp\04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe
"C:\Users\Admin\AppData\Local\Temp\04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Local\Temp\04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe
  "C:\Users\Admin\AppData\Local\Temp\04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe"
  2⤵
  PID:1384

memory/1384-10-0x0000000000080000-0x0000000000122000-memory.dmp

Filesize
648KB

Download
memory/1384-5-0x0000000000080000-0x0000000000122000-memory.dmp

Filesize
648KB

Download
memory/1384-7-0x0000000000080000-0x0000000000122000-memory.dmp

Filesize
648KB

Download
memory/1384-8-0x0000000000080000-0x0000000000122000-memory.dmp

Filesize
648KB

Download
memory/1384-9-0x0000000000080000-0x0000000000122000-memory.dmp

Filesize
648KB

Download
memory/1384-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1384-14-0x0000000000080000-0x0000000000122000-memory.dmp

Filesize
648KB

Download
memory/2276-1-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/2276-2-0x00000000003F0000-0x000000000043E000-memory.dmp

Filesize
312KB

Download
memory/2276-3-0x0000000004B50000-0x0000000004B90000-memory.dmp

Filesize
256KB

Download
memory/2276-4-0x00000000003A0000-0x00000000003A8000-memory.dmp

Filesize
32KB

Download
memory/2276-0-0x0000000000A80000-0x0000000000AF2000-memory.dmp

Filesize
456KB

Download
memory/2276-15-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download