lokibot

General

Target

6d82d3927b9b87282ed17b9df5477539_JaffaCakes118
Size

1.1MB
Sample

240524-ghx5msfe99
MD5

6d82d3927b9b87282ed17b9df5477539
SHA1

ebf81aa55cdb676ef7b5dcd0ec47188c641e93c4
SHA256

44b7f1a0bbdab6175749184a630e7445b16eb0c9e6671c453aabce8f3ced5922
SHA512

7666e617167801009e7ad11b8c926ae341dc08b6d2bb849ede1118eca583ef0f2881a7b0c3f59c079e78da9d40fb6401ecb1b502d8b6ff691c0ab34b8a9838b1
SSDEEP

24576:G9x3C+HqUjAE3QWhqx7Z96qoi/9x3C+HqUjAE3QWhqx7Z96qoiF:G9x35H38CQR7ZKy9x35H38CQR7ZKW

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://tkanilux.com.ua/xy/Panel/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  hab.exe
- Size
  
  802KB
- MD5
  
  6fa59c037085c8f1d744da3f0bcf4404
- SHA1
  
  99540076afe5478f0268f5cc35449b510b883fc2
- SHA256
  
  adcf0b372228b76e987deecd0f45733e93dee3a798258546612a8f2232044d81
- SHA512
  
  23f8d74f6483886f71a939f7ea36dcc476a95115e6d05db0e1fa657495dadd8864f7ff2a3849f8fa3849decd5d8e53e0fce8f0184a1f30bd9f914c1dce9b9f0d
- SSDEEP
  
  12288:Cb6mCM9sXHh9BoRPqsxOVKuS5r70xwgeqh043L97/hO+mVvldcgcbqSw:7eSHhYRRxOVGcxJBdb1LwvOc
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  hab.exe
- Size
  
  802KB
- MD5
  
  6fa59c037085c8f1d744da3f0bcf4404
- SHA1
  
  99540076afe5478f0268f5cc35449b510b883fc2
- SHA256
  
  adcf0b372228b76e987deecd0f45733e93dee3a798258546612a8f2232044d81
- SHA512
  
  23f8d74f6483886f71a939f7ea36dcc476a95115e6d05db0e1fa657495dadd8864f7ff2a3849f8fa3849decd5d8e53e0fce8f0184a1f30bd9f914c1dce9b9f0d
- SSDEEP
  
  12288:Cb6mCM9sXHh9BoRPqsxOVKuS5r70xwgeqh043L97/hO+mVvldcgcbqSw:7eSHhYRRxOVGcxJBdb1LwvOc
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Lokibot

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4