lokibot

General

Target
a4e13d5ddfed2748925ccf8cb2a08cf03f992de943e195aa73411e1fd2efab80.exe
Size 518KB
Sample241120-dssfcsyhrf
SHA256 a4e13d5ddfed2748925ccf8cb2a08cf03f992de943e195aa73411e1fd2efab80
MD5 7c7f42431e94008eaf3e6857101792e4
SHA1 973497ad5d0725b431d1d9b3f2c8f2ef7c20382a
SHA512 fa54bcd4394326c6e5c44841d31f29c0011ebb088b8d85d8d1b4054c6207a9dccc6b92e4e54c9574763cf06df1c521dee458aabaee7cc4ff40a5110e735d3b6c
SSDEEP 12288:ZOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPi2AAGXBvFwkmy:Zq5TfcdHj4fmbJ09ekx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://87.120.113.235/18/pin.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  a4e13d5ddfed2748925ccf8cb2a08cf03f992de943e195aa73411e1fd2efab80.exe
- Size 518KB
- SHA256 a4e13d5ddfed2748925ccf8cb2a08cf03f992de943e195aa73411e1fd2efab80
- MD5 7c7f42431e94008eaf3e6857101792e4
- SHA1 973497ad5d0725b431d1d9b3f2c8f2ef7c20382a
- SHA512 fa54bcd4394326c6e5c44841d31f29c0011ebb088b8d85d8d1b4054c6207a9dccc6b92e4e54c9574763cf06df1c521dee458aabaee7cc4ff40a5110e735d3b6c
- SSDEEP 12288:ZOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPi2AAGXBvFwkmy:Zq5TfcdHj4fmbJ09ekx
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection discovery spyware stealer trojan upx
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
  collection
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Lokibot family

Drops startup file

Executes dropped EXE

Loads dropped DLL

Accesses Microsoft Outlook profiles

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2