lokibot

General

Target

464306b2b7c7ba38c7e13b19cc992b02_JaffaCakes118
Size

582KB
Sample

240515-p4l89sad83
MD5

464306b2b7c7ba38c7e13b19cc992b02
SHA1

62a3831002f0cb4ff4b82e6f4bd07a3c9f7540d7
SHA256

b4ba23c5be67aaa2d868c91521bbf1b7ad7321474fbc4e11d2b0ec737468d917
SHA512

7e5facf630b0e25db39bccae6f6a47ef56cf3ef18b88c3496e8bfe48a628c080b0282ccf74a34c9b4d97c58da19d4a5443ca1e8bd2812eb77c56c4cbbf6f0faa
SSDEEP

12288:vYV6MorX7qzuC3QHO9FQVHPF51jgcrY0Zq+YXjnR:8BXu9HGaVHdZq+YzR

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://185.79.156.15/$01/ju/4Qc/cat.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  464306b2b7c7ba38c7e13b19cc992b02_JaffaCakes118
- Size
  
  582KB
- MD5
  
  464306b2b7c7ba38c7e13b19cc992b02
- SHA1
  
  62a3831002f0cb4ff4b82e6f4bd07a3c9f7540d7
- SHA256
  
  b4ba23c5be67aaa2d868c91521bbf1b7ad7321474fbc4e11d2b0ec737468d917
- SHA512
  
  7e5facf630b0e25db39bccae6f6a47ef56cf3ef18b88c3496e8bfe48a628c080b0282ccf74a34c9b4d97c58da19d4a5443ca1e8bd2812eb77c56c4cbbf6f0faa
- SSDEEP
  
  12288:vYV6MorX7qzuC3QHO9FQVHPF51jgcrY0Zq+YXjnR:8BXu9HGaVHdZq+YzR
Score

10^/10

lokibot collection spyware stealer trojan upx
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses Microsoft Outlook profiles
  collection
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

UPX packed file

Accesses Microsoft Outlook profiles

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2