lokibot

General

Target

94bdebbfd12c3bd62b3bc24c83f71e9a765b19220e9d4a5d2bec383301b5de76.exe
Size

1.5MB
Sample

250326-xvje1s1vdy
MD5

b5aa0a354a2b0f7a3688c9ed024e2f04
SHA1

71d36f38584852072e2ddb3bc991c86d0b7dea50
SHA256

94bdebbfd12c3bd62b3bc24c83f71e9a765b19220e9d4a5d2bec383301b5de76
SHA512

67d13dbc099daf221e6ef52cca80b4f0dcc1a41a46b33369611e830017938d4ecd3be31afe0af77559dfb4a2473a41d8efc3225276a4a29d18ee18a103f081b0
SSDEEP

49152:fRCTPz99vLJM4iEngkRCip4VljKnJxUEifndEHqAC1zI/2cCiMh:fRCDHXt3AiYjKPUEqnde9sk/2nim

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://beesco.net/second/chief3/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  94bdebbfd12c3bd62b3bc24c83f71e9a765b19220e9d4a5d2bec383301b5de76.exe
- Size
  
  1.5MB
- MD5
  
  b5aa0a354a2b0f7a3688c9ed024e2f04
- SHA1
  
  71d36f38584852072e2ddb3bc991c86d0b7dea50
- SHA256
  
  94bdebbfd12c3bd62b3bc24c83f71e9a765b19220e9d4a5d2bec383301b5de76
- SHA512
  
  67d13dbc099daf221e6ef52cca80b4f0dcc1a41a46b33369611e830017938d4ecd3be31afe0af77559dfb4a2473a41d8efc3225276a4a29d18ee18a103f081b0
- SSDEEP
  
  49152:fRCTPz99vLJM4iEngkRCip4VljKnJxUEifndEHqAC1zI/2cCiMh:fRCDHXt3AiYjKPUEqnde9sk/2nim
Score

10^/10

discovery upx lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Accesses Microsoft Outlook profiles
  collection
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Lokibot family

Accesses Microsoft Outlook profiles

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2