lokibot

General

Target

972ef638b803266c9fe4afce93a2f0a4a2a880b7a93a6c250209c55dea295ee0.exe
Size

990KB
Sample

240511-b4t28aec3s
MD5

9de9a50ec8399bcbea1697aed7f6b093
SHA1

71997994585f06160d84ac92555b2eadaacfaed3
SHA256

972ef638b803266c9fe4afce93a2f0a4a2a880b7a93a6c250209c55dea295ee0
SHA512

c717604050139d6d7579ae90ebaf201f4f615c75b69163c2f0720ebe23448e6c8e88e1e91c8732ce6b4a2ff569e4c43e8e6d1fd09a148607ebbb75c9244fad3c
SSDEEP

24576:7xlH0Rs/OSeKVTzAd9zpthYjMNuZ+FOPSKs0:NlH0Rs/OSes8NthYjMNuZ+FOPSK

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://195.123.211.210/evie1/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  972ef638b803266c9fe4afce93a2f0a4a2a880b7a93a6c250209c55dea295ee0.exe
- Size
  
  990KB
- MD5
  
  9de9a50ec8399bcbea1697aed7f6b093
- SHA1
  
  71997994585f06160d84ac92555b2eadaacfaed3
- SHA256
  
  972ef638b803266c9fe4afce93a2f0a4a2a880b7a93a6c250209c55dea295ee0
- SHA512
  
  c717604050139d6d7579ae90ebaf201f4f615c75b69163c2f0720ebe23448e6c8e88e1e91c8732ce6b4a2ff569e4c43e8e6d1fd09a148607ebbb75c9244fad3c
- SSDEEP
  
  24576:7xlH0Rs/OSeKVTzAd9zpthYjMNuZ+FOPSKs0:NlH0Rs/OSes8NthYjMNuZ+FOPSK
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects executables containing common artifacts observed in infostealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Detects executables containing common artifacts observed in infostealers

Detects executables referencing many file transfer clients. Observed in information stealers

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2