lokibot

General

Target

7d72439e82ac01968abb65c833b9feb73e8b59337408f5d347c754615e579920.exe
Size

560KB
Sample

240517-b2evhsbe97
MD5

169780a46f76750795f20c6ace3a0efd
SHA1

5dace2b67be08c5e759098bb0eaefa1915c4e7bc
SHA256

7d72439e82ac01968abb65c833b9feb73e8b59337408f5d347c754615e579920
SHA512

1759c734f8fa0b3762efa58a24e11f1ea4ca883ed00b0b29882bf02cc6848b5dab29a723cbb29d53c75a5a20d204086d21df7d7bc3645a7df06fefdb4b5a71b9
SSDEEP

12288:I0pei36Reiy/vwTEJnoT+AfoFROFvYR7ubZ5hn92c3oNBw+kzVZXx:Lpp36hy/2EJo3gFROFAAbZ5hcOiBw+kd

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/d1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  7d72439e82ac01968abb65c833b9feb73e8b59337408f5d347c754615e579920.exe
- Size
  
  560KB
- MD5
  
  169780a46f76750795f20c6ace3a0efd
- SHA1
  
  5dace2b67be08c5e759098bb0eaefa1915c4e7bc
- SHA256
  
  7d72439e82ac01968abb65c833b9feb73e8b59337408f5d347c754615e579920
- SHA512
  
  1759c734f8fa0b3762efa58a24e11f1ea4ca883ed00b0b29882bf02cc6848b5dab29a723cbb29d53c75a5a20d204086d21df7d7bc3645a7df06fefdb4b5a71b9
- SSDEEP
  
  12288:I0pei36Reiy/vwTEJnoT+AfoFROFvYR7ubZ5hn92c3oNBw+kzVZXx:Lpp36hy/2EJo3gFROFAAbZ5hcOiBw+kd
Score

10^/10

lokibot collection execution spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects executables containing common artifacts observed in infostealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2