lokibot

General

Target

d723e44ff112549ee9456ff75ff003fd_JaffaCakes118
Size

283KB
Sample

240909-1k6z4stekh
MD5

d723e44ff112549ee9456ff75ff003fd
SHA1

f19f6d1b4aefd2bb2d8b51131a622e3c1d6a8ce8
SHA256

0f147439bfb2debcd03f5c3ae75974a9f70201eeb1a5d6b77c124f627b18fceb
SHA512

20a86a481e6d8b1138154ee8f5c36a168c08b2556eebf083c2c4ae3c5dcf9e462b3ee728102b621ba11a9c0e8b73878c93b15469a69fd52b8081f2706f93eb62
SSDEEP

6144:Cnan2fGK+wa/fM3lVBPV2SS9aG54xczm2MJIppyy6r:CnanZK+wa/fM3lVLMaEBzm2MJIpp

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://mclhk-net.com/chanelstv/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  d723e44ff112549ee9456ff75ff003fd_JaffaCakes118
- Size
  
  283KB
- MD5
  
  d723e44ff112549ee9456ff75ff003fd
- SHA1
  
  f19f6d1b4aefd2bb2d8b51131a622e3c1d6a8ce8
- SHA256
  
  0f147439bfb2debcd03f5c3ae75974a9f70201eeb1a5d6b77c124f627b18fceb
- SHA512
  
  20a86a481e6d8b1138154ee8f5c36a168c08b2556eebf083c2c4ae3c5dcf9e462b3ee728102b621ba11a9c0e8b73878c93b15469a69fd52b8081f2706f93eb62
- SSDEEP
  
  6144:Cnan2fGK+wa/fM3lVBPV2SS9aG54xczm2MJIppyy6r:CnanZK+wa/fM3lVLMaEBzm2MJIpp
Score

10^/10

lokibot discovery spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2