lokibot

General

Target

10022025_1527_Objednvka_PO208919_Agropodnik_A.S_Trnava.iso.zip
Size

128KB
Sample

250210-sy76bswqht
MD5

680be2ac1d240cbfcdbb1a2c1960faf0
SHA1

171a7357b938fccc89fa6b3d9d73f385081e8934
SHA256

995e15583a563a4d618022a5097dce5d060855ce88a3c24b02f6b3bd5421fb32
SHA512

fb96e6ead518ff4aa550fd9a1de33e1622192de6cbb68937cdc7b1eedef2516efba800f5bd6ed9e0b5f1d2fe188bd117d8372c29e866ebc029bbda873596c9fe
SSDEEP

3072:QE2IA1WCiUslrpyJVTrbM2OXpM4qTALP3r1u49Iqmcwm6Upm/6P/v:QEmnrYrmbjGW4Hfj9jb6wm/gv

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

https://taurusfood-com-ua.cfd/RLO/PWS/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  Objednávka_(PO208919)_Agropodnik_A.S_Trnava.exe
- Size
  
  205KB
- MD5
  
  522be3a6169aafdcd8cb667335561a1e
- SHA1
  
  9d973aa0c89ef14d8352655fa96fda19199e2f1d
- SHA256
  
  607ae2812c4933e7dc70081e55dac398f6729e32708ab1a723c2340dca6bd501
- SHA512
  
  1cdeb1798ec1bbd77db3592606d6781d4ed77ae87021609d549814ca6eee037cd8b918bf7b21d9dd949f5fe4ac34d4ad7c5b0d019744137f7b41291c0f6acc6f
- SSDEEP
  
  3072:w/hjZYOLYwIs9rLM2OXps4qlALF3r1u45Iymcwm6Upm/W6OEAmjc+e:ohjpLjG64D9j5Tb6wm/uEAmg+
Score

10^/10

lokibot collection discovery spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Lokibot family

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2