lokibot

Resubmissions

26/03/2025, 16:57

250326-vgh6zs1ms4 10

26/03/2025, 16:40

250326-t61a5aywhw 10

26/03/2025, 16:26

250326-txrmmazr18 10

Sharing

Copy URL

Twitter E-mail

General

Target

8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
Size

1.5MB
Sample

250326-t61a5aywhw
MD5

04f4042f2f96b4c74ec2b336905d469c
SHA1

4b917ef74b8b08c44d83c4dfe8f56a40e72cad32
SHA256

8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388
SHA512

62dcab3c5c7cf1c698e7c96c6d0603646c7332140fec969d63389cf739a1b4a8abb5ffce311ab89a04287d250e27c48e5354b498ccbcd76db417034ee389fd7a
SSDEEP

49152:uRCTPz99vLJM4iEngkRCip4VljKnJxUEifndEHqAC1zI/2cCiMh5:uRCDHXt3AiYjKPUEqnde9sk/2nim5

Score

10^/10

Malware Config

Extracted

Family

lokibot

http://beesco.net/second/chief3/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
- Size
  
  1.5MB
- MD5
  
  04f4042f2f96b4c74ec2b336905d469c
- SHA1
  
  4b917ef74b8b08c44d83c4dfe8f56a40e72cad32
- SHA256
  
  8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388
- SHA512
  
  62dcab3c5c7cf1c698e7c96c6d0603646c7332140fec969d63389cf739a1b4a8abb5ffce311ab89a04287d250e27c48e5354b498ccbcd76db417034ee389fd7a
- SSDEEP
  
  49152:uRCTPz99vLJM4iEngkRCip4VljKnJxUEifndEHqAC1zI/2cCiMh5:uRCDHXt3AiYjKPUEqnde9sk/2nim5
Score

10^/10

lokibot collection discovery spyware stealer trojan upx
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Accesses Microsoft Outlook profiles
  collection
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral10 behavioral11 behavioral12 behavioral13 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Lokibot family

Accesses Microsoft Outlook profiles

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13