lokibot

General

Target

Comprobante.lnk.lnk
Size

2KB
Sample

241003-h2mzfs1cpn
MD5

b234c46d1f63b18ad2dc3f824bc0d6fa
SHA1

fbdcce6b33b9e0ffbba48aadca0db9059af37141
SHA256

8cd7bd86c1cc1be6d0c553fc3e8e02232b70363fadc3212989b1599a70c668d3
SHA512

883b59b949966ac9a4b04f51a5298f842b94c80423dec3dd35105c4c61724cde142b7a781a8fab9da32c6748e4d205af7c74f1acd09388f5d19600ac8da97883

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://www.sodiumlaurethsulfatedesyroyer.com/flow/sfdkavhbsfvhahlbfabreaireuafrgfyarfdkabrbfvakysrgfea/zdhkbgualsbifbAFRAWYEGFYAUGEYGywefafaer/nezfdio.pif

Extracted

Family

lokibot

C2

http://freighteighttwocam.ddns.net/mdifygidj/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  Comprobante.lnk.lnk
- Size
  
  2KB
- MD5
  
  b234c46d1f63b18ad2dc3f824bc0d6fa
- SHA1
  
  fbdcce6b33b9e0ffbba48aadca0db9059af37141
- SHA256
  
  8cd7bd86c1cc1be6d0c553fc3e8e02232b70363fadc3212989b1599a70c668d3
- SHA512
  
  883b59b949966ac9a4b04f51a5298f842b94c80423dec3dd35105c4c61724cde142b7a781a8fab9da32c6748e4d205af7c74f1acd09388f5d19600ac8da97883
Score

10^/10

lokibot collection discovery execution spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2