lokibot

Sharing

Copy URL

Twitter E-mail

General

Target

Pasūtījums_(PO50234)_SIA_VAK.iso
Size

254KB
Sample

250211-mzyemavnhw
MD5

2e0c9f82cbeed19f46a8c10f9e3d9a41
SHA1

5a2a44ac8ee933c62621041eb81d0d170c3c9c33
SHA256

15b55000ca92a31e3e4a8cf922c0a05dee61c1d8f44337fed5bcdbf0eebdedb3
SHA512

67491741a443632dbea657c9a28a06ecd30f82c3e32b87cfdc78b99ac354eff48ed414885e4e703a008c17b89709e7c8bf6e19f48d759fbb289898ed23621eb4
SSDEEP

3072:nUPYPRLDfgZ27Y5+Mi6hDZIHxEpE0Xm2oHMrrqu71l3/rkF0:nUP0RXfKnrH22mMreu7n/w

Score

10^/10

Malware Config

Extracted

Family

lokibot

https://ddrtot.shop/New/PWS/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  Pasūtījums_(PO50234)_SIA_VAK.iso
- Size
  
  254KB
- MD5
  
  2e0c9f82cbeed19f46a8c10f9e3d9a41
- SHA1
  
  5a2a44ac8ee933c62621041eb81d0d170c3c9c33
- SHA256
  
  15b55000ca92a31e3e4a8cf922c0a05dee61c1d8f44337fed5bcdbf0eebdedb3
- SHA512
  
  67491741a443632dbea657c9a28a06ecd30f82c3e32b87cfdc78b99ac354eff48ed414885e4e703a008c17b89709e7c8bf6e19f48d759fbb289898ed23621eb4
- SSDEEP
  
  3072:nUPYPRLDfgZ27Y5+Mi6hDZIHxEpE0Xm2oHMrrqu71l3/rkF0:nUP0RXfKnrH22mMreu7n/w
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral1 behavioral2 behavioral3
- Target
  
  out.iso
- Size
  
  254KB
- MD5
  
  2e0c9f82cbeed19f46a8c10f9e3d9a41
- SHA1
  
  5a2a44ac8ee933c62621041eb81d0d170c3c9c33
- SHA256
  
  15b55000ca92a31e3e4a8cf922c0a05dee61c1d8f44337fed5bcdbf0eebdedb3
- SHA512
  
  67491741a443632dbea657c9a28a06ecd30f82c3e32b87cfdc78b99ac354eff48ed414885e4e703a008c17b89709e7c8bf6e19f48d759fbb289898ed23621eb4
- SSDEEP
  
  3072:nUPYPRLDfgZ27Y5+Mi6hDZIHxEpE0Xm2oHMrrqu71l3/rkF0:nUP0RXfKnrH22mMreu7n/w
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral4 behavioral5 behavioral6
- Target
  
  Pasūtījums_(PO50234)_SIA_VAK.exe
- Size
  
  194KB
- MD5
  
  e161e070cdc4f438c40c4cdc2326fa27
- SHA1
  
  5777cc7b1cbdaf545bd38cb57eca9f5966b21171
- SHA256
  
  a361358c79a61e6781d0ccd512d2fa7222bd2025346ca9494279c8072129d91f
- SHA512
  
  2fc9bf43b31c868c1bf24d82ebe9f754a27187fc3b6bdb40a7592b0c46afd245c22ed425b1f9bb4515b7a5775b15b169588366d9b9bb0aee0902eb16dc7d0ba5
- SSDEEP
  
  3072:KUPYPRLDfgZ27Y5+Mi6hDZIHxEpE0Xm2oHMrrqu71l3/rkF0:KUP0RXfKnrH22mMreu7n/w
Score

10^/10

lokibot collection discovery spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Downloads MZ/PE file
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral7 behavioral8 behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Downloads MZ/PE file

Downloads MZ/PE file

Lokibot family

Downloads MZ/PE file

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9