lokibot

General

Target

20778595e538b4ef30d9053e1934b67f115d338f27a01e9a858f84e729fdce28.exe
Size

568KB
Sample

240521-bfhdhsda85
MD5

4e2a32898a1efd013915d15cc28b9039
SHA1

340557785d063449f120ccbed60371b4e45bb1ab
SHA256

20778595e538b4ef30d9053e1934b67f115d338f27a01e9a858f84e729fdce28
SHA512

0aaa866f4f3f38ab0859775cd75f1370d13c63d62307ef48f3b46a5ff8c517301509fdc99ce49754221834de6789583774deff8cb7651d4934e788f19b5e2bfc
SSDEEP

12288:+eWET/mr9Khj8lTbtmXPymsdgE49ZoCN4fPr+fCKKJ:+eWtCYX86iEsoTlJ

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/d1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  20778595e538b4ef30d9053e1934b67f115d338f27a01e9a858f84e729fdce28.exe
- Size
  
  568KB
- MD5
  
  4e2a32898a1efd013915d15cc28b9039
- SHA1
  
  340557785d063449f120ccbed60371b4e45bb1ab
- SHA256
  
  20778595e538b4ef30d9053e1934b67f115d338f27a01e9a858f84e729fdce28
- SHA512
  
  0aaa866f4f3f38ab0859775cd75f1370d13c63d62307ef48f3b46a5ff8c517301509fdc99ce49754221834de6789583774deff8cb7651d4934e788f19b5e2bfc
- SSDEEP
  
  12288:+eWET/mr9Khj8lTbtmXPymsdgE49ZoCN4fPr+fCKKJ:+eWtCYX86iEsoTlJ
Score

10^/10

lokibot collection execution spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects executables containing common artifacts observed in infostealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2