lokibot

General

Target

20052024_1615_SipariÅŸ_(P.O_R40277304)_Hasel Ä°stif Makineleri Tic. A.Åž.vbs
Size

860KB
Sample

240520-tqlssshd8s
MD5

e74235674803d05c4fccafb9216849b1
SHA1

d02acadae00ee5f361d249d690c863c1461a3efa
SHA256

bcdb4f1af705889ace73e8a0c8626bc6b615393a4c4f28ea00e5a51eb6e541d9
SHA512

34af31f44146bf0c7ccd83756f42a17a6014bb3ea124fb3e4445828ab1920afb6e852e94c71c4f75ed89e956df2e497103999ac3a955a335d2f63339a3ea2bdc
SSDEEP

6144:gF8Kvv2sHeGrhlGusXBkd/bHkRuy0HsF8Kvv2sHeGrhlGusXBkd/bHkRuy0HE:Yvv2e1uusxkVuIEvv2e1uusxkVuIE

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

https://altaskifer.sbs/PWS2/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  20052024_1615_SipariÅŸ_(P.O_R40277304)_Hasel Ä°stif Makineleri Tic. A.Åž.vbs
- Size
  
  860KB
- MD5
  
  e74235674803d05c4fccafb9216849b1
- SHA1
  
  d02acadae00ee5f361d249d690c863c1461a3efa
- SHA256
  
  bcdb4f1af705889ace73e8a0c8626bc6b615393a4c4f28ea00e5a51eb6e541d9
- SHA512
  
  34af31f44146bf0c7ccd83756f42a17a6014bb3ea124fb3e4445828ab1920afb6e852e94c71c4f75ed89e956df2e497103999ac3a955a335d2f63339a3ea2bdc
- SSDEEP
  
  6144:gF8Kvv2sHeGrhlGusXBkd/bHkRuy0HsF8Kvv2sHeGrhlGusXBkd/bHkRuy0HE:Yvv2e1uusxkVuIEvv2e1uusxkVuIE
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Checks computer location settings

Executes dropped EXE

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2