lokibot

General

Target

7a212c998e95baab13f8f3157665d6f8da5ca82d21d11b60a9f2fe3c5e53b492.exe
Size

589KB
Sample

200630-8yn3f1gh8x
MD5

9d10243d9bb92abdff699e688612de5a
SHA1

ad5b063857a7dbc03ca1b6c5c91ba897d53000ca
SHA256

7a212c998e95baab13f8f3157665d6f8da5ca82d21d11b60a9f2fe3c5e53b492
SHA512

12061197ce50fd4b43baa0bebeb1279df7bcea07ba929a34b3b57890b4a8a2caa72854539dd1415e4db21359ac281d4348d33d61f735da065021475d3dd8ebbd

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

airmanselectiontest.com/oo/Panel/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  7a212c998e95baab13f8f3157665d6f8da5ca82d21d11b60a9f2fe3c5e53b492.exe
- Size
  
  589KB
- MD5
  
  9d10243d9bb92abdff699e688612de5a
- SHA1
  
  ad5b063857a7dbc03ca1b6c5c91ba897d53000ca
- SHA256
  
  7a212c998e95baab13f8f3157665d6f8da5ca82d21d11b60a9f2fe3c5e53b492
- SHA512
  
  12061197ce50fd4b43baa0bebeb1279df7bcea07ba929a34b3b57890b4a8a2caa72854539dd1415e4db21359ac281d4348d33d61f735da065021475d3dd8ebbd
Score

10^/10

trojan spyware stealer lokibot
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2