lokibot | b433aada97bdf82afa6f8e09529dac5aecca443706776bfa590892a6586384a3 | Triage

Sharing

General

Target

b433aada97bdf82afa6f8e09529dac5aecca443706776bfa590892a6586384a3
Size

621KB
Sample

240516-gyx5ksfg47
MD5

921ebb24154d8168ee0b8beab6e2a56e
SHA1

c97a02a4094cf8870f34de75b377c7f63b8542f7
SHA256

b433aada97bdf82afa6f8e09529dac5aecca443706776bfa590892a6586384a3
SHA512

f0ebb976f2259a54f2e1b1822620904dacac83d020c7ba0a5246584451995ddd6de8b9d8249a88d1162e2e37c62a22e495740c538e98f441c1eab7df2c012421
SSDEEP

12288:jSiF99MlJSDtUg8n2SHllnxU/O4a8NIrSf9wrNw+EeeBoX:m6V0lCVQNZH9X

Score

10^/10

lokibot collection evasion execution spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

https://franccoisfreres.com/PWS/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  bf69d7e6dc53d7406f9ca42a77aab58d4fab67d8c0778f71efc77a9fb653e4c9.exe
- Size
  
  835KB
- MD5
  
  ec6570ba3ecd5ce8ec00e775eebe3872
- SHA1
  
  e449ffc0d43aad5dea985ddb2ae506a28e548f88
- SHA256
  
  bf69d7e6dc53d7406f9ca42a77aab58d4fab67d8c0778f71efc77a9fb653e4c9
- SHA512
  
  9cefd277e30b232bc661826cf0361d8b0f028378002112b114123ad92317cc610425add500a6858367de7aa60599092d9641eb0af1b58fd16850a970fd6001f8
- SSDEEP
  
  12288:Ftzd+m39dkAf5YSyBThO6QEJ7KJajLYDcks2qIUtd88ZAFfhAR/e4Fkf:FthkszyqFYKqYHMIN8iFZARG4U
Score

10^/10

execution lokibot collection evasion spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

lokibotcollectionevasionexecutionspywarestealertrojan