lokibot

General

Target

PRI_VTK250419A.exe
Size

944KB
Sample

250225-r1bdpszrs4
MD5

d45ab46d87bb599ccc62569c10d2d323
SHA1

d7010744a6dc830a79406b04ce281c7b60cc531a
SHA256

f29f7c7516de91fc3d8e1d6c23590cc5c73a9123176cd6b742c8d5c23d5da9f5
SHA512

7abb34238334e294e8d13e1bc90db54fafa1b151738da434412625e8808dfe633449c780a98112b70b2520c572d5aa5e8501507f24fbb2ffdc02f92b0c8cb5bf
SSDEEP

24576:Du6J33O0c+JY5UZ+XC0kGso6Fam9GwLqWY:Nu0c++OCvkGs9Fam9Gw1Y

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://touxzw.ir/scc1/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  PRI_VTK250419A.exe
- Size
  
  944KB
- MD5
  
  d45ab46d87bb599ccc62569c10d2d323
- SHA1
  
  d7010744a6dc830a79406b04ce281c7b60cc531a
- SHA256
  
  f29f7c7516de91fc3d8e1d6c23590cc5c73a9123176cd6b742c8d5c23d5da9f5
- SHA512
  
  7abb34238334e294e8d13e1bc90db54fafa1b151738da434412625e8808dfe633449c780a98112b70b2520c572d5aa5e8501507f24fbb2ffdc02f92b0c8cb5bf
- SSDEEP
  
  24576:Du6J33O0c+JY5UZ+XC0kGso6Fam9GwLqWY:Nu0c++OCvkGs9Fam9Gw1Y
Score

10^/10

lokibot collection discovery spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Lokibot family

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2