lokibot | ee8578ebf209462c50f37d8fceb524db53b5b97078aa0995c775133b8d3f9d64 | Triage

Sharing

General

Target

Ordine di acquisto_(PO102429)_OFT_PUMPS.exe
Size

204KB
Sample

250217-ntjvqaymay
MD5

f04e54b14850e86d7079e75f9212d0af
SHA1

f9ac755df86475a7bd6ec258f906df7bbaa5420b
SHA256

ee8578ebf209462c50f37d8fceb524db53b5b97078aa0995c775133b8d3f9d64
SHA512

bbc0f9c6c449bc39ac928e84421af5bb6f19402e144af9daf696a2395e4ccf2dd168cab5d6a8928c83a9925ea1f6b90ec55dc7bf7a6a3e41a0570538b8f3ab48
SSDEEP

3072:DEa1A11XjI3flVMrbQfDJ1h0i1iZIHxEpE0Xm2oHMrrqu71l3/rkV0:jK19c5JB1MH22mMreu7n/g

Score

10^/10

lokibot collection discovery spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

https://ddrtot.shop/New/PWS/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  Ordine di acquisto_(PO102429)_OFT_PUMPS.exe
- Size
  
  204KB
- MD5
  
  f04e54b14850e86d7079e75f9212d0af
- SHA1
  
  f9ac755df86475a7bd6ec258f906df7bbaa5420b
- SHA256
  
  ee8578ebf209462c50f37d8fceb524db53b5b97078aa0995c775133b8d3f9d64
- SHA512
  
  bbc0f9c6c449bc39ac928e84421af5bb6f19402e144af9daf696a2395e4ccf2dd168cab5d6a8928c83a9925ea1f6b90ec55dc7bf7a6a3e41a0570538b8f3ab48
- SSDEEP
  
  3072:DEa1A11XjI3flVMrbQfDJ1h0i1iZIHxEpE0Xm2oHMrrqu71l3/rkV0:jK19c5JB1MH22mMreu7n/g
Score

10^/10

lokibot collection discovery spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Downloads MZ/PE file
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

lokibotcollectiondiscoveryspywarestealertrojan

behavioral2

lokibotcollectiondiscoveryspywarestealertrojan