lokibot

General

Target

f4c0448c427e926b0d3c0d1fbc1a866e_JaffaCakes118
Size

564KB
Sample

241215-tmk24ayqfv
MD5

f4c0448c427e926b0d3c0d1fbc1a866e
SHA1

273aa64fd2523237acde7d342a09a259a3c5499a
SHA256

cee3904c1eb0245328cbbe8770f69417d56218ba9ed6ded95d60183264557fef
SHA512

605665259a268ccf31d01c6332693d259f37efa72e517dc6bc09c5fc66b53b274bfd9f111607499f9aad64c87aa70b8c9c21fe69a6c532b193e2704f1ce9fd1c
SSDEEP

12288:qVAsGfYtKR7zmF4WdwGexfoAu9kcNuuh5:qVAsGfYtKR7yFjdwGexf5u9kcNuuh5

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

https://publicspeaking.co.id/okoye/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  f4c0448c427e926b0d3c0d1fbc1a866e_JaffaCakes118
- Size
  
  564KB
- MD5
  
  f4c0448c427e926b0d3c0d1fbc1a866e
- SHA1
  
  273aa64fd2523237acde7d342a09a259a3c5499a
- SHA256
  
  cee3904c1eb0245328cbbe8770f69417d56218ba9ed6ded95d60183264557fef
- SHA512
  
  605665259a268ccf31d01c6332693d259f37efa72e517dc6bc09c5fc66b53b274bfd9f111607499f9aad64c87aa70b8c9c21fe69a6c532b193e2704f1ce9fd1c
- SSDEEP
  
  12288:qVAsGfYtKR7zmF4WdwGexfoAu9kcNuuh5:qVAsGfYtKR7yFjdwGexf5u9kcNuuh5
Score

10^/10

lokibot collection discovery spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Lokibot family

Uses the VBS compiler for execution

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2