lokibot | f071dd3805dfa0d51994b786af825c9e5454d2fca098e82163669cc2dec725e4

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.NSIS.Inject.rmv.5eaec4c04c16dbbf894e0ab791fb98cf
Size 250KB
Sample261016-eaqdqa1w2p
SHA256 f071dd3805dfa0d51994b786af825c9e5454d2fca098e82163669cc2dec725e4
MD5 5eaec4c04c16dbbf894e0ab791fb98cf
SHA1 51c8b565faf2a358648f740e16044aff80a95936
SHA512 f0485a2c6f226b5c411470f7637a3ba23f31a5d416bfe427a111b235c06d4a0aa2f6fe719e5fdd04c25cdfd0504f83e2a35ec9b55837992ae4ed23d18756a1e7
SSDEEP 6144:OmIoA8eNezQFsHobi30/gJIjPKCu/RW3Rw5+1Ntta65HQH:OmIT48U73QQIrKHpWBwkDvA
TLSH
T1BE44029A92F4812BC9B78FB11D374257B6B57A442C71970F2304DE6C3C33B85CA49BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

lokibot

http://9873.my.to/pauloo/pau.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  jaffacakes118_Trojan.NSIS.Inject.rmv.5eaec4c04c16dbbf894e0ab791fb98cf
- Size 250KB
- SHA256 f071dd3805dfa0d51994b786af825c9e5454d2fca098e82163669cc2dec725e4
- MD5 5eaec4c04c16dbbf894e0ab791fb98cf
- SHA1 51c8b565faf2a358648f740e16044aff80a95936
- SHA512 f0485a2c6f226b5c411470f7637a3ba23f31a5d416bfe427a111b235c06d4a0aa2f6fe719e5fdd04c25cdfd0504f83e2a35ec9b55837992ae4ed23d18756a1e7
- SSDEEP 6144:OmIoA8eNezQFsHobi30/gJIjPKCu/RW3Rw5+1Ntta65HQH:OmIT48U73QQIrKHpWBwkDvA
- TLSH
  T1BE44029A92F4812BC9B78FB11D374257B6B57A442C71970F2304DE6C3C33B85CA49BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery lokibot spyware stealer trojan
- Family: Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
- MD5 75ed96254fbf894e42058062b4b4f0d1
- SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
- SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
- SSDEEP 192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
- TLSH
  T1E0327D1293E044F2F191853C086B3B5AAB7A65099BE24EA79FE381817D15AD6BD3D303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $TEMP/29.rsrc
- Size 2KB
- SHA256 5f232e74103626f8f59a6b96eb5fd734e2a7968544202f931aa42b39fe3c2515
- MD5 54070efa1b162be1fba9e9035da5a571
- SHA1 070a4134d6bd04ec4375b8624074069ea19dfc25
- SHA512 f804300777523fb28eae427ff21efd94a6b6fca861dd52e8a8c7cecee4e51603e6d1c50af5b2d51691b52bbf01a27dba217f1aacd9dce7cd5f6c1e29d06e97a2
- TLSH
  T1C351E0A1C4EA563583324227E7901B50FA1009F7876DA0E8799D223B1FF6C47177B76B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $TEMP/Venussflytrap.dll
- Size 100KB
- SHA256 78eca2d779348f8b80cecc4dfddd9b4ad0eaeccc99efa0ac49ea78ebe282561c
- MD5 ea0d50dafd70fffb4c71ca775a672228
- SHA1 97a418322a94aa914e65d0bea337af185af414fd
- SHA512 fddea65f8ad3cebfd833ad7ab3a6ef0162c2930859c86beacf618c2e735c6ec79a57aaa852ab23a1bed717fd7b70072277f59c408cee21395b6182fffae4b9fc
- SSDEEP 1536:SnBZRfocrAyTyM43nQJDYGiS3TEUmFY356OjHVQWtFuQR8lMuifCH2c4sfER3URO:Cfd/TyMOWDYtUTh35rHF+uCWcdDR
- TLSH
  T1CCA39E55B1DDC075C1AE5C3C606E6B832A3DD0B8DE548F67D0812AF82A507A36EE138F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $TEMP/msadomd28.tlb
- Size 13KB
- SHA256 462cd1c066015c1c7e654a4a33b1f204d73807f02420f81e7cfc420aa316d353
- MD5 2d8aef0653d0c2fdd51b26f70efd9194
- SHA1 25ff0c7168f06d264d147fd0fb64edcb7631572c
- SHA512 5eea77684948ff8ffb0528bb439b7802b400024e9d4ffb80b72fa8a44f5df74ce012dc821c8942212c50073ffd2210ea476f5f697949532ee600a21a79fb2033
- SSDEEP 192:cx+IWPbAWGHzr1KHgbkyjRz+EzacooRMBGDCbKydW66CwWbol/5UgpavCF7oF7/s:cAIWDAWw0KuW6nxbqBUK1
- TLSH
  T12752AC05BB84C9A7D50D0232084766EB6F70EC442F62A36B6385777D1D737C8AD09ABE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9