lokibot | 9d04b33f9d2dafe1acf704df3d5919e10c8388372eae311449d44d682055f457 | Triage

Sharing

General

Target

ödeme makbuzunu onayla.exe
Size

1.7MB
Sample

240703-klfxbayfnr
MD5

4537711df69a7a0a692e1d1fcb4ee698
SHA1

89e73e00115cc34be26af6b8dd19c3e0eaf47efa
SHA256

9d04b33f9d2dafe1acf704df3d5919e10c8388372eae311449d44d682055f457
SHA512

adcb0b216c0a31e2401eac7c78dec6b46dc5928e3ba0ce61cb332f3a454d27b5a2815c87584a97e62db2cb7abec1f5f1ebe492fd8608aae4fe5f5727a545f74d
SSDEEP

12288:GeTS/n4E8qFRpC6DAjz5kbl/PiL0mIjafE0dx:G18qnxAjzWkKjac03

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://andrebadi.top/ugopounds/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  ödeme makbuzunu onayla.exe
- Size
  
  1.7MB
- MD5
  
  4537711df69a7a0a692e1d1fcb4ee698
- SHA1
  
  89e73e00115cc34be26af6b8dd19c3e0eaf47efa
- SHA256
  
  9d04b33f9d2dafe1acf704df3d5919e10c8388372eae311449d44d682055f457
- SHA512
  
  adcb0b216c0a31e2401eac7c78dec6b46dc5928e3ba0ce61cb332f3a454d27b5a2815c87584a97e62db2cb7abec1f5f1ebe492fd8608aae4fe5f5727a545f74d
- SSDEEP
  
  12288:GeTS/n4E8qFRpC6DAjz5kbl/PiL0mIjafE0dx:G18qnxAjzWkKjac03
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

lokibotcollectionspywarestealertrojan

behavioral2

lokibotcollectionspywarestealertrojan