lokibot

General

Target

JaffaCakes118_53eeccaf35ecfd7d2ad816ac0539614d
Size

242KB
Sample

250107-hqbr2s1pbq
MD5

53eeccaf35ecfd7d2ad816ac0539614d
SHA1

075a8ef2a53da6862c3187b6ff72559cbcb4638c
SHA256

bfa5e0df0e8fc72b9a2da771243de237e867dcb313146e9772885f9013d84a1e
SHA512

71aaf05c09cf23c7ed775e7dc9a8bba8a9b764686a46680ba86ffb80bff2693e13adcfff999e671eeeb9b1c4ab3b90f0bac310e6449fb74430038d6086c6d88a
SSDEEP

6144:wBlL/ctPkBeT12OP1UPNCNsygDObvZW+It/STUkRf4dINtrn:CetP51K64qhNIt/4Ukqd2tL

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://63.250.40.204/~wpdemo/file.php?search=719442

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  JaffaCakes118_53eeccaf35ecfd7d2ad816ac0539614d
- Size
  
  242KB
- MD5
  
  53eeccaf35ecfd7d2ad816ac0539614d
- SHA1
  
  075a8ef2a53da6862c3187b6ff72559cbcb4638c
- SHA256
  
  bfa5e0df0e8fc72b9a2da771243de237e867dcb313146e9772885f9013d84a1e
- SHA512
  
  71aaf05c09cf23c7ed775e7dc9a8bba8a9b764686a46680ba86ffb80bff2693e13adcfff999e671eeeb9b1c4ab3b90f0bac310e6449fb74430038d6086c6d88a
- SSDEEP
  
  6144:wBlL/ctPkBeT12OP1UPNCNsygDObvZW+It/STUkRf4dINtrn:CetP51K64qhNIt/4Ukqd2tL
Score

10^/10

lokibot collection discovery spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/owbf.dll
- Size
  
  38KB
- MD5
  
  a3e66854ebc39bf5c56dba367d8151c4
- SHA1
  
  8421a86d7772cd2191c753421c6c42fb0c41ec05
- SHA256
  
  0c2e690572d7a0a66dfaff96486f73d456b34c5a7e37cfacc74fceaff4db9c62
- SHA512
  
  752324f9a0e5edeed8960d886460ca02bee5b4bc8a7b729a13a685b883c7190345dc202fb944d02056ede705abc248d346efc76127cd2c3a75447808814c39f2
- SSDEEP
  
  384:v2dM18Yb19J7ZX4qFTrtR1836QFlqIknaqRCz+7N/YvU8PI2gqf0j:vLR19J7ZFTJ7arFlRkh/Ys8Fja
Score

10^/10

lokibot collection discovery spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Blocklisted process makes network request
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral3 behavioral4