lokibot

General

Target

JaffaCakes118_8ac2bdfeae0ff6156bb667f42d832c81
Size

239KB
Sample

250108-ewhwrstmf1
MD5

8ac2bdfeae0ff6156bb667f42d832c81
SHA1

30e43fc578ca13150a5c85f7b899719619dcda2a
SHA256

c1403c854426614a4d7bf78afdb7687aa7f20e66024be5ad05d331cfbceab7ff
SHA512

a8170ea3797ffe80d16abe7469944b5baf3babf6b2d11e4775c79ad5ced25f26f2eb4d0b933ba29aa6d4b065f95a496ff513a207099f970817b32db917a1af7a
SSDEEP

6144:wBlL/cHco/HkHqs7IPcKbQMMz8vPMLFGZ:CeHcKsCcaMpFc

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://63.250.40.204/~wpdemo/file.php?search=719442

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  JaffaCakes118_8ac2bdfeae0ff6156bb667f42d832c81
- Size
  
  239KB
- MD5
  
  8ac2bdfeae0ff6156bb667f42d832c81
- SHA1
  
  30e43fc578ca13150a5c85f7b899719619dcda2a
- SHA256
  
  c1403c854426614a4d7bf78afdb7687aa7f20e66024be5ad05d331cfbceab7ff
- SHA512
  
  a8170ea3797ffe80d16abe7469944b5baf3babf6b2d11e4775c79ad5ced25f26f2eb4d0b933ba29aa6d4b065f95a496ff513a207099f970817b32db917a1af7a
- SSDEEP
  
  6144:wBlL/cHco/HkHqs7IPcKbQMMz8vPMLFGZ:CeHcKsCcaMpFc
Score

10^/10

lokibot collection discovery spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/lfpnfont.dll
- Size
  
  20KB
- MD5
  
  fa424f9b0c98afafb0671959f35139fb
- SHA1
  
  25f5c5139e5248c85f122eb42cdafc2d974d507a
- SHA256
  
  969d24cf93578bfd20c823ef79580dd61e007b00023fad94238e3e2e4bd5a479
- SHA512
  
  9176814ef19f8a1da11007b6d9c264308fae22905401f383bf516507bd6e210164644d588be177ea5c04667eeae520abfb4a0646a084f480c99bc433445f03e1
- SSDEEP
  
  192:Fn1UP8lpn1nw8GUQ2963lfaLb7J24PiUr249D78L70fI6Yt00R5/dGvBPMGxWs:F1UPep1wxyeaH7ooc70fI670FexW
Score

10^/10

lokibot collection discovery spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Blocklisted process makes network request
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral3 behavioral4