lokibot | 4e15eab180712f99efe5eea760beea458c7bfc4eeb5f5961b2b5d0c9b7611d3d | Triage

Sharing

General

Target

4e15eab180712f99efe5eea760beea458c7bfc4eeb5f5961b2b5d0c9b7611d3d.hta
Size

130KB
Sample

241026-byvfssyeqp
MD5

0b1aa8ae190d05df71f4052fae67df5b
SHA1

f6fe29f3e7830b15e3b244ba83216c029dcb60fb
SHA256

4e15eab180712f99efe5eea760beea458c7bfc4eeb5f5961b2b5d0c9b7611d3d
SHA512

94008a8bf00a1334c16129258243bf89d8351c82ede845fefdb657838fe2f602f761b9935e5fef5e01b368096993f49a48e65d3705cea948d9435db0df370a04
SSDEEP

96:Eam7QSo4DH5wo4DH5rtTRJP4srvjTKP4DH5Sr4DH5NFAb5UAf4DH5G7T:Ea2Rok0RLknYoVT

Score

10^/10

lokibot defense_evasion discovery execution spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

exe.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

Extracted

Family

lokibot

C2

http://94.156.177.220/logs/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  4e15eab180712f99efe5eea760beea458c7bfc4eeb5f5961b2b5d0c9b7611d3d.hta
- Size
  
  130KB
- MD5
  
  0b1aa8ae190d05df71f4052fae67df5b
- SHA1
  
  f6fe29f3e7830b15e3b244ba83216c029dcb60fb
- SHA256
  
  4e15eab180712f99efe5eea760beea458c7bfc4eeb5f5961b2b5d0c9b7611d3d
- SHA512
  
  94008a8bf00a1334c16129258243bf89d8351c82ede845fefdb657838fe2f602f761b9935e5fef5e01b368096993f49a48e65d3705cea948d9435db0df370a04
- SSDEEP
  
  96:Eam7QSo4DH5wo4DH5rtTRJP4srvjTKP4DH5Sr4DH5NFAb5UAf4DH5G7T:Ea2Rok0RLknYoVT
Score

10^/10

defense_evasion discovery execution lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Evasion via Device Credential Deployment
  defense_evasion execution
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryexecution

behavioral2

lokibotdefense_evasiondiscoveryexecutionspywarestealertrojan