lokibot

General

Target
8f9bed5d03737615e413841056b188061834c62bdb4511d169cdeb117c2af4c8
Size 715KB
Sample240510-ah2dqsae62
SHA256 8f9bed5d03737615e413841056b188061834c62bdb4511d169cdeb117c2af4c8
MD5 527e417d7bf0c62853a5b0706eb11855
SHA1 b49bc435fbb5e3eb92dfbd919acb50df31912ca4
SHA512 1f9c9e8f945c54eac35e9c69f70864858fc5ec4094cbb1a430def647ffd085ec47186d08a4bd10c6cac224320f76f46d5c1c142153bf3db16e0944534c1f00e1
SSDEEP 12288:9l2pxDLJipbWXOVISPnnkFsoIz5NhNFZxzxkyUH1zF:eKbWXOVPnkFAz5tHxNkrH1zF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/d4/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  8f9bed5d03737615e413841056b188061834c62bdb4511d169cdeb117c2af4c8
- Size 715KB
- SHA256 8f9bed5d03737615e413841056b188061834c62bdb4511d169cdeb117c2af4c8
- MD5 527e417d7bf0c62853a5b0706eb11855
- SHA1 b49bc435fbb5e3eb92dfbd919acb50df31912ca4
- SHA512 1f9c9e8f945c54eac35e9c69f70864858fc5ec4094cbb1a430def647ffd085ec47186d08a4bd10c6cac224320f76f46d5c1c142153bf3db16e0944534c1f00e1
- SSDEEP 12288:9l2pxDLJipbWXOVISPnnkFsoIz5NhNFZxzxkyUH1zF:eKbWXOVPnkFAz5tHxNkrH1zF
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot spyware stealer trojan collection
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects executables containing common artifacts observed in infostealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Detects executables containing common artifacts observed in infostealers

Detects executables referencing many file transfer clients. Observed in information stealers

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2