lokibot

General

Target
66a64f84f91c1dd2bc4b9f01faf15d40_JaffaCakes118
Size 245KB
Sample240401-d6hhbach93
SHA256 662b44a7fd7d5d5042c05dd3e049e52844d613febdde0ee9dd96d50a3ac55513
MD5 66a64f84f91c1dd2bc4b9f01faf15d40
SHA1 21812f5c0a37e7b479f1dcc63237d0070e04c076
SHA512 08b4fe874cc4cf0cc70a501e92a55a66396918197cf718b1ae632b223d899b56f0132925314cfadacb2f08f373559df331bd223257a792cb656fbcefec783380
SSDEEP 6144:wBlL/ch4YPNYPUL6BM+WUT71/+F9XZHoN1zELbMeVD5Zc+B0I6:Ceh4GN8RM+j0za1gPxVD5FB0b
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://63.250.40.204/~wpdemo/file.php?search=723855
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  66a64f84f91c1dd2bc4b9f01faf15d40_JaffaCakes118
- Size 245KB
- SHA256 662b44a7fd7d5d5042c05dd3e049e52844d613febdde0ee9dd96d50a3ac55513
- MD5 66a64f84f91c1dd2bc4b9f01faf15d40
- SHA1 21812f5c0a37e7b479f1dcc63237d0070e04c076
- SHA512 08b4fe874cc4cf0cc70a501e92a55a66396918197cf718b1ae632b223d899b56f0132925314cfadacb2f08f373559df331bd223257a792cb656fbcefec783380
- SSDEEP 6144:wBlL/ch4YPNYPUL6BM+WUT71/+F9XZHoN1zELbMeVD5Zc+B0I6:Ceh4GN8RM+j0za1gPxVD5FB0b
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/atzfnwlbz.dll
- Size 43KB
- SHA256 649545c1a63dc5397987051b5d2a345fcb87bbf7ea8cfc1e15f668f0c3f5bb18
- MD5 b19970ad6a9300060d8b0f43cb4de34a
- SHA1 60e4629ed93e58eb0e894a23254028353aaa71ae
- SHA512 4eddef779ceea9abe92be5a9cf151709c89e3cae92dc916bdd075deb0df3f430950f8183a6a45730c9e1c16838673474b79e233c54cd13fe23495d2f5210d864
- SSDEEP 768:E6tefip4O73Qet5EdYkyHgrm+ukNO9yyjYsUAPH4IEt:E6teqpB7gDYvTjYsUAPMt
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Blocklisted process makes network request
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral3 behavioral4