lokibot

General

Target

FDE165F7E76CBF60D25787D02B9747F8.exe
Size

361KB
Sample

240422-x6ntwafa97
MD5

fde165f7e76cbf60d25787d02b9747f8
SHA1

02a9b832afb11b92b93928f0402444cb9eacf325
SHA256

e980e437d08d2b60f888f0970241f2a5c0eec09653cb9a228ab77bba425e8551
SHA512

5411bd53ad6a747e648d67fb22e154cf3dc753d73815696b74e559056e7ece33e0c3058fa6b5ac06cc85317a5e82c9f705e52f2d7b03f7077c8dc3438bab8093
SSDEEP

6144:lJTvOJI7+z3/DGEEMA6GIymEoDZ57jWBLIkdFCaKmO3xGAwM5EtYRIyd3gmJYI:DTgfPRWIy0DfjWB8cF5KmO3x/wHYRIyt

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://91.92.253.228/vgbashgdvgvbhkbjhqwrgrthyuj/hjqwretyuiopadshnjmklomfhbqaxinhgbfwrftgyujicn/iplkrtikfmjdnsbgatefv/yughghjbjgbjhsdgstgsdhysyryyrs/uhgbnte/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  FDE165F7E76CBF60D25787D02B9747F8.exe
- Size
  
  361KB
- MD5
  
  fde165f7e76cbf60d25787d02b9747f8
- SHA1
  
  02a9b832afb11b92b93928f0402444cb9eacf325
- SHA256
  
  e980e437d08d2b60f888f0970241f2a5c0eec09653cb9a228ab77bba425e8551
- SHA512
  
  5411bd53ad6a747e648d67fb22e154cf3dc753d73815696b74e559056e7ece33e0c3058fa6b5ac06cc85317a5e82c9f705e52f2d7b03f7077c8dc3438bab8093
- SSDEEP
  
  6144:lJTvOJI7+z3/DGEEMA6GIymEoDZ57jWBLIkdFCaKmO3xGAwM5EtYRIyd3gmJYI:DTgfPRWIy0DfjWB8cF5KmO3x/wHYRIyt
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2