lokibot

General

Target

3fdbef7cbaaa5ad1d15d3ecd6f54f5d875d3296737579689148b8798033a2b0cN
Size

199KB
Sample

240930-tqj9zayckf
MD5

bdd219ed9e9cb4ba6566a02591bc0890
SHA1

d441b327479a6fb1224911a1e2ff80b979aca0bf
SHA256

3fdbef7cbaaa5ad1d15d3ecd6f54f5d875d3296737579689148b8798033a2b0c
SHA512

b44e80f9b96b9df4dd090b6a026496373219e1ef2bac93928787e8c7200f1781ac66501c2cb1581979ca2d2c6f48583ac7c8a8334e01e723f313d6f74f9e1f6c
SSDEEP

6144:VNZZmX5Q50rp7OilBzXhSjkPmKzMmin0p0:VNCXu50rROCNSjgmKIse

Score

10^/10

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Extracted

Family

lokibot

C2

http://45.133.1.20/oluwa/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  3fdbef7cbaaa5ad1d15d3ecd6f54f5d875d3296737579689148b8798033a2b0cN
- Size
  
  199KB
- MD5
  
  bdd219ed9e9cb4ba6566a02591bc0890
- SHA1
  
  d441b327479a6fb1224911a1e2ff80b979aca0bf
- SHA256
  
  3fdbef7cbaaa5ad1d15d3ecd6f54f5d875d3296737579689148b8798033a2b0c
- SHA512
  
  b44e80f9b96b9df4dd090b6a026496373219e1ef2bac93928787e8c7200f1781ac66501c2cb1581979ca2d2c6f48583ac7c8a8334e01e723f313d6f74f9e1f6c
- SSDEEP
  
  6144:VNZZmX5Q50rp7OilBzXhSjkPmKzMmin0p0:VNCXu50rROCNSjgmKIse
Score

10^/10

lokibot sality backdoor collection discovery evasion spyware stealer trojan upx
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses Microsoft Outlook profiles
  collection
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  
  dqbqm.exe
- Size
  
  4KB
- MD5
  
  9e97fa67ee2f72bd5fe817b69e7052aa
- SHA1
  
  310a10f5be2ec6a26f1290cbddc31617b21dd6ab
- SHA256
  
  cf4c39eb098cf3ef872c73963061fae1e99cf60d3e3014f22c7ed65d5d2abd26
- SHA512
  
  10aa5eb2cddb998aef08cdb609d86aefdd55039eee70e14aae53ae557957c060b54f52cbfcfd5d5e64719ad122769b445da43ad63d89ae2a943c0b24fb6d18f4
- SSDEEP
  
  48:vpgo2oIoUY39jJFQhHheIPiceulG8KvAGI3V6TIkt/tYmR:BPllhJKPxlgAGI38trVR
Score

3^/10

discovery
behavioral3 behavioral4