lokibot

General

Target

7a67c5f3ebfe4608d1eba7d0884424d7093df2dc49487ff0488cdff5e021c885
Size

501KB
Sample

241126-k37rcs1kgk
MD5

ebdcb8b4df7cdabf965667c9dc00aae1
SHA1

2194b9de3b190e8ec6cb30bc311e27aa3502e352
SHA256

7a67c5f3ebfe4608d1eba7d0884424d7093df2dc49487ff0488cdff5e021c885
SHA512

42acbbfb9a9f716dfce38e04fb59eccc375f810a1b61daea114077cf4f3dd6a75da797add40e3e1f2813abf84c29b20aeb31952fd123d24eba5a8fdf6ed953ac
SSDEEP

12288:Bk2EiFnx2PynUCJXU9EGMuRCCYMmfgknmkWirVox2brqR8g9XghdHeE5:Bk2EiFilCS9T5KJmjiax2iqlv5

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://94.156.177.41/alpha/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  Proforma Invoices Oct & Nov.exe
- Size
  
  525KB
- MD5
  
  3102ded8150ab50942806fece47877d9
- SHA1
  
  0ea08a674c07a4f354ed7501788db4e3e17298c0
- SHA256
  
  c14f938d6e95748fc2a3102fad37c48cc3d720cbe43420822c1b6da13ed800f5
- SHA512
  
  4d18f8076876afe0a455350cf057e507324840235929557d6199d40d601df18dfe00ca96835a13cafddf429cbe9536f8db476e7f658ddaf764e8e906ec56a7de
- SSDEEP
  
  12288:DOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiUVrRGghXgLxH4oJ:Dq5TfcdHj4fmbVQN/J
Score

10^/10

lokibot collection discovery spyware stealer trojan upx
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Accesses Microsoft Outlook profiles
  collection
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Lokibot family

Accesses Microsoft Outlook profiles

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2