lokibot | 31607008c03354cf7b6b21d8d3ecc31186e39a92dca54c0c26c30ecd85957cec | Triage

Sharing

General

Target

31607008c03354cf7b6b21d8d3ecc31186e39a92dca54c0c26c30ecd85957cec.exe
Size

940KB
Sample

240528-rhp45sge5w
MD5

e3d3d93759a0552c63ec2c3ccbf6c383
SHA1

cfa0d6279822bc75a22e54e3dcb6e378a0772605
SHA256

31607008c03354cf7b6b21d8d3ecc31186e39a92dca54c0c26c30ecd85957cec
SHA512

a907954c0554dfa1f20f87e1c71e32f65276197672065d321b249fba96662b7ab853e12a67482d2c860213d63ab76ead7b69bb89c19931bc2fcca7dbbf83e8c7
SSDEEP

24576:sAHnh+eWsN3skA4RV1Hom2KXMmHaIEUS6WH5:Lh+ZkldoPK8YaIEUjq

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

https://edgewell.cam/DV2/PWS/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  31607008c03354cf7b6b21d8d3ecc31186e39a92dca54c0c26c30ecd85957cec.exe
- Size
  
  940KB
- MD5
  
  e3d3d93759a0552c63ec2c3ccbf6c383
- SHA1
  
  cfa0d6279822bc75a22e54e3dcb6e378a0772605
- SHA256
  
  31607008c03354cf7b6b21d8d3ecc31186e39a92dca54c0c26c30ecd85957cec
- SHA512
  
  a907954c0554dfa1f20f87e1c71e32f65276197672065d321b249fba96662b7ab853e12a67482d2c860213d63ab76ead7b69bb89c19931bc2fcca7dbbf83e8c7
- SSDEEP
  
  24576:sAHnh+eWsN3skA4RV1Hom2KXMmHaIEUS6WH5:Lh+ZkldoPK8YaIEUjq
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

lokibotcollectionspywarestealertrojan

behavioral2

lokibotcollectionspywarestealertrojan