lokibot

General

Target
db0086d6c41fea58417b589f20de1b52_JaffaCakes118
Size 245KB
Sample240405-wpn8msaf2w
SHA256 ed5e8ff7e2e5e830e2265ab6d76a5889a656444e157237426c0504a21a517471
MD5 db0086d6c41fea58417b589f20de1b52
SHA1 8cfe6a4bee30822edc96334be85877edd40c1c81
SHA512 21f5c92f4bde2b1e4a8312bf6419b3dab3504a00299de8f4de1b361fbdb8aef18ac8cc5a222c5a4e6146a702c0437d34fccc0f7059c934f358bcd57a50699074
SSDEEP 6144:wBlL/c3OeNyv4fEHPol4kfzyvM0Sh9vIc9m5SeTicN4o:CedJfwZvpShq0Pcuo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://74f26d34ffff049368a6cff8812f86ee.ml/BN22/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  db0086d6c41fea58417b589f20de1b52_JaffaCakes118
- Size 245KB
- SHA256 ed5e8ff7e2e5e830e2265ab6d76a5889a656444e157237426c0504a21a517471
- MD5 db0086d6c41fea58417b589f20de1b52
- SHA1 8cfe6a4bee30822edc96334be85877edd40c1c81
- SHA512 21f5c92f4bde2b1e4a8312bf6419b3dab3504a00299de8f4de1b361fbdb8aef18ac8cc5a222c5a4e6146a702c0437d34fccc0f7059c934f358bcd57a50699074
- SSDEEP 6144:wBlL/c3OeNyv4fEHPol4kfzyvM0Sh9vIc9m5SeTicN4o:CedJfwZvpShq0Pcuo
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/sogqjgayoly.dll
- Size 35KB
- SHA256 416c75dbb19ed40f62e8d02219faa4ef0c1568e1507b7d58fc0090871534dd48
- MD5 3486630808a1ce5c9754676814e058bd
- SHA1 be6b220984f8554e4f98d6d4f9512d13525f5572
- SHA512 3d9556ada0379eae4a70878317a609349f49c44f256e4c3cf4249e17cee4728eab476c6f30525dffc53422e17541534ed126a9059ec8b0dd055e380b4ec10452
- SSDEEP 768:KYjdXnijLBTXd2JWMW3JNyXVciwrBus0+a7:hJnGLBTN2PVXVciGu5+a
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral3 behavioral4