lokibot

General

Target

bbfbda085e25a916cd854b912c821147_JaffaCakes118
Size

362KB
Sample

241203-ghfwcsykhr
MD5

bbfbda085e25a916cd854b912c821147
SHA1

ae56c17a8a8e42b810e9aa91c6ae841719008245
SHA256

1ca9fafe21bb096346d74200fe9857efbdc14c2fc69574d61926c5f8f2a92ac9
SHA512

bd0702f4771717632641eef18b508ab686c035b9dfcce7d6112373a78e5e5d8744c87dd344ec13268b9f4943d68358e7b5e516ba3f728f4c196e43a1b411fc1f
SSDEEP

6144:V99p6q1Eo/Ne0GL49Vl1jeHZyL4b8yvuDbLwVqCy6q+yxU/LVlNzNVQY+UG:V99p6q1Eo/N9GkPDGmDbyq7jU5lxNOY

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

https://ammachegroup.com/wap/wp-content/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  bbfbda085e25a916cd854b912c821147_JaffaCakes118
- Size
  
  362KB
- MD5
  
  bbfbda085e25a916cd854b912c821147
- SHA1
  
  ae56c17a8a8e42b810e9aa91c6ae841719008245
- SHA256
  
  1ca9fafe21bb096346d74200fe9857efbdc14c2fc69574d61926c5f8f2a92ac9
- SHA512
  
  bd0702f4771717632641eef18b508ab686c035b9dfcce7d6112373a78e5e5d8744c87dd344ec13268b9f4943d68358e7b5e516ba3f728f4c196e43a1b411fc1f
- SSDEEP
  
  6144:V99p6q1Eo/Ne0GL49Vl1jeHZyL4b8yvuDbLwVqCy6q+yxU/LVlNzNVQY+UG:V99p6q1Eo/N9GkPDGmDbyq7jU5lxNOY
Score

10^/10

lokibot collection discovery spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Drops startup file
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Lokibot family

Drops startup file

Uses the VBS compiler for execution

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2