lokibot

General

Target

cef42c4eebef7898a33689d47d34e57080905bb87eba06780dc15221806a57ad.exe
Size

437KB
Sample

241124-ancbsszrfk
MD5

5baffcf102d67671f64de97984115d3e
SHA1

acc9a728a8d830fa6204bdc1023a9314b0ad8268
SHA256

cef42c4eebef7898a33689d47d34e57080905bb87eba06780dc15221806a57ad
SHA512

7b0f02bc5dbb876d1c9cc4d44b6577a7158567ac558edbe399ca2661217bbcc794ef79c9b3b46563d1a45c5be6957b10cf8c220f3ed0284b5268065e1379b07b
SSDEEP

6144:HBlL/JhFS7pqxIK2JEHlt1bQuc36IAIHmfokEh9vbIx2NeAfuKRGwF:hRYpq+K8EHltqu2Hwwju0uKRGwF

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://secure01-redirect.net/ga19/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  cef42c4eebef7898a33689d47d34e57080905bb87eba06780dc15221806a57ad.exe
- Size
  
  437KB
- MD5
  
  5baffcf102d67671f64de97984115d3e
- SHA1
  
  acc9a728a8d830fa6204bdc1023a9314b0ad8268
- SHA256
  
  cef42c4eebef7898a33689d47d34e57080905bb87eba06780dc15221806a57ad
- SHA512
  
  7b0f02bc5dbb876d1c9cc4d44b6577a7158567ac558edbe399ca2661217bbcc794ef79c9b3b46563d1a45c5be6957b10cf8c220f3ed0284b5268065e1379b07b
- SSDEEP
  
  6144:HBlL/JhFS7pqxIK2JEHlt1bQuc36IAIHmfokEh9vbIx2NeAfuKRGwF:hRYpq+K8EHltqu2Hwwju0uKRGwF
Score

10^/10

lokibot collection discovery spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/kufxksnp.dll
- Size
  
  19KB
- MD5
  
  46862d69970121be6edf5839496261f2
- SHA1
  
  f97c78fe600090cd6b98c96ab9668e527f2a9c6b
- SHA256
  
  6f5e305b03c19ff5b051516466812f3cd7b8a02b71dec9dbfd7455998bc91a23
- SHA512
  
  214179d5eac81cae6ad99a1bc89a67959444787ddf34143bccc67e176ff6c0a450730b9e2242fd275bca2e8c73e40f1dfad2d3ed4ee359924d34a3983d108fd5
- SSDEEP
  
  384:zgbU2V3gJ4Lqwxs9oII7OSLHyevbdr38Pbx5z:zgA2NOwWICESizs15z
Score

10^/10

lokibot collection discovery spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Blocklisted process makes network request
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral3 behavioral4