lokibot

General

Target

22102024_0148_21102024_Замовлення на купівлю_(PO478403)_ТОВ «ТАСТА ЛІСКІ Трубодеталь».zip
Size

138KB
Sample

241022-b781jszdlb
MD5

c69df480d19da8028741f64b944b4e95
SHA1

357a3a6d90956f409109d573c98e3b655dba9de7
SHA256

506c613b4ea8b304b883dd4af2ad9073954662252f2fbd70a4206c8a798dca59
SHA512

868cfbf07d17a445d3d6720a873cf36fdd6044a72a48934a7bf5936118b1bf918754de34dccdbbce8f19698f283f968d448fde6b649c7000b75fc734a97aa284
SSDEEP

3072:sjUgPiH0efZtk2Y4ogWcJEma5yPGqUIivgCmPcbNNGOsa3V/f845F:sogPiH3fHnNJJEmasjE9+c/GX2V/B

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

https://dddotx.shop/Mine/PWS/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  Замовлення на купівлю_(PO478403)_ТОВ «ТАСТА ЛІСКІ Трубодеталь».exe
- Size
  
  183KB
- MD5
  
  d1d899b06642500d72acaeb42896b348
- SHA1
  
  69683cca8c559a7cc2b6484ea982b2ca44be7a2f
- SHA256
  
  7cfbe6d3f41c153c78f4e24211ffd891cde46411f072d83798e0e03e140a7021
- SHA512
  
  69a69e0546a0972135b34561f530765046649296be879f83606d613a00c5a1b5f48b4bb91df1f91854dba3d80e4ce5c82fe03670ea0c1c4cbef0856c030312e5
- SSDEEP
  
  3072:Dj2RbI+4N6qZjddV5stDIoMNLGcJEma5cPGWUIi3gCmPc/NNsOsajV5f8ve:D+mZ5z2DeJEmaW1C9+cTsXwV5G
Score

10^/10

lokibot collection discovery spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2