lokibot

General

Target

JaffaCakes118_6fcc51fa6b19798c3821287aac712871
Size

437KB
Sample

250107-vxyava1jet
MD5

6fcc51fa6b19798c3821287aac712871
SHA1

b20fc64a49a5808f4460f02581de977736df0a29
SHA256

7675d05ed54e7dbf0713f0ae49310d9ddd7b20b436b03907d1d6bd9570eb79b7
SHA512

e8a5a2f76a65254c4afdf56841e36ad7d504131ad7201587af0aabfc243afef7905a6990e86f7f3d3babc7e69efaf1cb052b7d87aae72b2ac4c3603f2d80d39b
SSDEEP

6144:HBlL/JhFS7pqxIK2JEHlt1bQuc36IAIHmfokEh9vbIx2NeAfuKRGwd:hRYpq+K8EHltqu2Hwwju0uKRGwd

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://secure01-redirect.net/ga19/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  JaffaCakes118_6fcc51fa6b19798c3821287aac712871
- Size
  
  437KB
- MD5
  
  6fcc51fa6b19798c3821287aac712871
- SHA1
  
  b20fc64a49a5808f4460f02581de977736df0a29
- SHA256
  
  7675d05ed54e7dbf0713f0ae49310d9ddd7b20b436b03907d1d6bd9570eb79b7
- SHA512
  
  e8a5a2f76a65254c4afdf56841e36ad7d504131ad7201587af0aabfc243afef7905a6990e86f7f3d3babc7e69efaf1cb052b7d87aae72b2ac4c3603f2d80d39b
- SSDEEP
  
  6144:HBlL/JhFS7pqxIK2JEHlt1bQuc36IAIHmfokEh9vbIx2NeAfuKRGwd:hRYpq+K8EHltqu2Hwwju0uKRGwd
Score

10^/10

lokibot collection discovery spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/kufxksnp.dll
- Size
  
  19KB
- MD5
  
  46862d69970121be6edf5839496261f2
- SHA1
  
  f97c78fe600090cd6b98c96ab9668e527f2a9c6b
- SHA256
  
  6f5e305b03c19ff5b051516466812f3cd7b8a02b71dec9dbfd7455998bc91a23
- SHA512
  
  214179d5eac81cae6ad99a1bc89a67959444787ddf34143bccc67e176ff6c0a450730b9e2242fd275bca2e8c73e40f1dfad2d3ed4ee359924d34a3983d108fd5
- SSDEEP
  
  384:zgbU2V3gJ4Lqwxs9oII7OSLHyevbdr38Pbx5z:zgA2NOwWICESizs15z
Score

10^/10

lokibot collection discovery spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Blocklisted process makes network request
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral3 behavioral4