lokibot

General

Target

JaffaCakes118_d0d80da52bd01843d38139b1ddf1ca3a
Size

245KB
Sample

250109-yhbp3syqcs
MD5

d0d80da52bd01843d38139b1ddf1ca3a
SHA1

da78153f04dae889906a621dcb1625035c4a292e
SHA256

64b919d36bd2047074cf6887e88e890871e9421305583a20da902265e31d15e4
SHA512

d0ab8c7ca8ebe802dbb80da9239c8eef49fa5206807d53981a51b3014a4c0b6932b3903ea80a5b96477341dee47002b8ab01d1f78a511d2d72dd402271941b16
SSDEEP

6144:wBlL/chDJGYkb1tHuldAvw0tmo5o9+75JJSu8IiXuZ0O1:CehFK1xmdetT5oE75jDzZv

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://63.250.40.204/~wpdemo/file.php?search=955547

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  JaffaCakes118_d0d80da52bd01843d38139b1ddf1ca3a
- Size
  
  245KB
- MD5
  
  d0d80da52bd01843d38139b1ddf1ca3a
- SHA1
  
  da78153f04dae889906a621dcb1625035c4a292e
- SHA256
  
  64b919d36bd2047074cf6887e88e890871e9421305583a20da902265e31d15e4
- SHA512
  
  d0ab8c7ca8ebe802dbb80da9239c8eef49fa5206807d53981a51b3014a4c0b6932b3903ea80a5b96477341dee47002b8ab01d1f78a511d2d72dd402271941b16
- SSDEEP
  
  6144:wBlL/chDJGYkb1tHuldAvw0tmo5o9+75JJSu8IiXuZ0O1:CehFK1xmdetT5oE75jDzZv
Score

10^/10

lokibot collection discovery spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/udpjzymus.dll
- Size
  
  38KB
- MD5
  
  35c7e2a63c059a4dbdb41078633ab8a2
- SHA1
  
  c718c7587166f41d2bd3ba94ee23bbb85ca16f96
- SHA256
  
  5d14d6480c4d20dd420d598d6e7f503b7e714ce9d21d56cc73a2f2dbcb1100af
- SHA512
  
  dc6c4b050269f8cda0e729a577121ea5468dc48e879d46bbf75b8830c6fc4be8e31d8ae296e888c93cb14a981f05c7e5253838c56a0d38120f7d76b9e8788ec2
- SSDEEP
  
  384:72dM15gbdVJIZX4qFTrtR1836QFlqIknaqRCz+7XEYDiRcHynTL0Jt3:7LAdVJIZFTJ7arFlRkzEYDiFnToJt3
Score

10^/10

lokibot collection discovery spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Blocklisted process makes network request
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral3 behavioral4