lokibot | 6773eb0fd0ed03747c434853b0549a7e7301d4d75f4228d7abff3c01d139448f | Triage

Sharing

General

Target

2025-02-07_8d7e901ce33cd45306deb615cf65e47e_icedid
Size

704KB
Sample

250207-c5jtbaxlfp
MD5

8d7e901ce33cd45306deb615cf65e47e
SHA1

dee0c4ae89def706920545c65329fd8ed9ec1288
SHA256

6773eb0fd0ed03747c434853b0549a7e7301d4d75f4228d7abff3c01d139448f
SHA512

3029d81b05907b38af4e73ed1e5b73bffaa01715aaa67e9a527f193d4a41fb1f3975d5794d0da70285f4b1b1c5db0aa0a59b04588c35a8dbd685555b6e6f0401
SSDEEP

12288:wxJeeS0UD/dQw5wq9azAuQQs0M834q+sV4JG:wy/TdQw559azGQAw

Score

10^/10

lokibot collection discovery spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://onlygoodman.com/his/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  2025-02-07_8d7e901ce33cd45306deb615cf65e47e_icedid
- Size
  
  704KB
- MD5
  
  8d7e901ce33cd45306deb615cf65e47e
- SHA1
  
  dee0c4ae89def706920545c65329fd8ed9ec1288
- SHA256
  
  6773eb0fd0ed03747c434853b0549a7e7301d4d75f4228d7abff3c01d139448f
- SHA512
  
  3029d81b05907b38af4e73ed1e5b73bffaa01715aaa67e9a527f193d4a41fb1f3975d5794d0da70285f4b1b1c5db0aa0a59b04588c35a8dbd685555b6e6f0401
- SSDEEP
  
  12288:wxJeeS0UD/dQw5wq9azAuQQs0M834q+sV4JG:wy/TdQw559azGQAw
Score

10^/10

lokibot collection discovery spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

lokibotcollectiondiscoveryspywarestealertrojan

behavioral2

lokibotcollectiondiscoveryspywarestealertrojan