lokibot

General

Target
7c55e395258e9e69d10502500d443ae0_JaffaCakes118
Size 241KB
Sample240401-2lr31shf89
SHA256 90aea5afb79d4a06dd87604c0e77067079fe149ba7d9c6db2308b64d7ad4d641
MD5 7c55e395258e9e69d10502500d443ae0
SHA1 e5cec42fec04f09cc8bac8d336063430a3ac023e
SHA512 18c925b4b5a0844ff23ebee9f057fc5b5685117bc7e62dfc8bd38f7dedc915e01641a8da6c968381e041a0354b475d25ae0edc3b1b76a2ce2d1f2c8d02ef6c63
SSDEEP 6144:wBlL/coLuNGYmoF45DsR65CGB5zCWONsqRJrjFUcl5+5:CexGYLF4S09UbrKcA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://136.243.159.53/~element/page.php?id=485
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  7c55e395258e9e69d10502500d443ae0_JaffaCakes118
- Size 241KB
- SHA256 90aea5afb79d4a06dd87604c0e77067079fe149ba7d9c6db2308b64d7ad4d641
- MD5 7c55e395258e9e69d10502500d443ae0
- SHA1 e5cec42fec04f09cc8bac8d336063430a3ac023e
- SHA512 18c925b4b5a0844ff23ebee9f057fc5b5685117bc7e62dfc8bd38f7dedc915e01641a8da6c968381e041a0354b475d25ae0edc3b1b76a2ce2d1f2c8d02ef6c63
- SSDEEP 6144:wBlL/coLuNGYmoF45DsR65CGB5zCWONsqRJrjFUcl5+5:CexGYLF4S09UbrKcA
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/zkyayjffrdi.dll
- Size 31KB
- SHA256 1fdc9ecfa8bddd5c3d7b77913cec4dba53263dac5b8f35cde40e920a58f2deca
- MD5 5850eabb38f5b0d1922054acd9b9f2c2
- SHA1 be60273f8322a4bf9fc6751c7c524a6b03822f50
- SHA512 cbafa1d03004a692851c1d9306e9c08d43d34f36f10d7c084d308e41e7c38a1774bc674ff6a230a5dd905b2dad91703f52c974fed42f0ebae179af05b257f885
- SSDEEP 768:WkJszi/0uyQzByH82eZ/lJlFm12nL7w0Tt:Ezd1QzBU82eZ9U10
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Blocklisted process makes network request
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral3 behavioral4