lokibot

General

Target

06b141da308fca09fab26963c3bb1ae851cf941b9dcfa269c5c640ef28f55fd7.exe
Size

239KB
Sample

241122-pbptpawnak
MD5

e697f9c6fe6143fe464019a1bceebd97
SHA1

2273f347360a05ab7b136086ac1643f3f20487ec
SHA256

06b141da308fca09fab26963c3bb1ae851cf941b9dcfa269c5c640ef28f55fd7
SHA512

9f6439c167ef0d7119614d80173bbe3c21c84d2509eaebb73ac3df5ac67ab56d5efc17296c870925007f9a2b3b9d34ec27badf4e7686d4ddd2665d7eee94dba7
SSDEEP

6144:wBlL/cHco/HkHqs7IPcKbQMMz8vPMLFGZ:CeHcKsCcaMpFc

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://63.250.40.204/~wpdemo/file.php?search=719442

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  06b141da308fca09fab26963c3bb1ae851cf941b9dcfa269c5c640ef28f55fd7.exe
- Size
  
  239KB
- MD5
  
  e697f9c6fe6143fe464019a1bceebd97
- SHA1
  
  2273f347360a05ab7b136086ac1643f3f20487ec
- SHA256
  
  06b141da308fca09fab26963c3bb1ae851cf941b9dcfa269c5c640ef28f55fd7
- SHA512
  
  9f6439c167ef0d7119614d80173bbe3c21c84d2509eaebb73ac3df5ac67ab56d5efc17296c870925007f9a2b3b9d34ec27badf4e7686d4ddd2665d7eee94dba7
- SSDEEP
  
  6144:wBlL/cHco/HkHqs7IPcKbQMMz8vPMLFGZ:CeHcKsCcaMpFc
Score

10^/10

lokibot collection discovery spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/lfpnfont.dll
- Size
  
  20KB
- MD5
  
  fa424f9b0c98afafb0671959f35139fb
- SHA1
  
  25f5c5139e5248c85f122eb42cdafc2d974d507a
- SHA256
  
  969d24cf93578bfd20c823ef79580dd61e007b00023fad94238e3e2e4bd5a479
- SHA512
  
  9176814ef19f8a1da11007b6d9c264308fae22905401f383bf516507bd6e210164644d588be177ea5c04667eeae520abfb4a0646a084f480c99bc433445f03e1
- SSDEEP
  
  192:Fn1UP8lpn1nw8GUQ2963lfaLb7J24PiUr249D78L70fI6Yt00R5/dGvBPMGxWs:F1UPep1wxyeaH7ooc70fI670FexW
Score

10^/10

lokibot collection discovery spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Blocklisted process makes network request
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral3 behavioral4