lokibot

General

Target

PO-USD#04072018.exe
Size

209KB
Sample

200630-h7bydjy6rj
MD5

9d99b9aff2251ca3b2ab0658ab1ec0a6
SHA1

b2e8a3ced8d1a4ef15432892ed2998920d4b7cd0
SHA256

e59a9f5da7389d07f3649a20a9e10135b7ab42c2c9711e8990b32aa3aa79eac8
SHA512

0d7fbfd5d3c72cd5557afcfcf805a650dcd14af308360f2bb18220276d632647baadb3c7752fef8dea79ba6bed7a951a9dc3ec358f1bc25a2beed6c416f432d0

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://egamcorps.ga/~zadmin/lmark/pvent/mode.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  PO-USD#04072018.exe
- Size
  
  209KB
- MD5
  
  9d99b9aff2251ca3b2ab0658ab1ec0a6
- SHA1
  
  b2e8a3ced8d1a4ef15432892ed2998920d4b7cd0
- SHA256
  
  e59a9f5da7389d07f3649a20a9e10135b7ab42c2c9711e8990b32aa3aa79eac8
- SHA512
  
  0d7fbfd5d3c72cd5557afcfcf805a650dcd14af308360f2bb18220276d632647baadb3c7752fef8dea79ba6bed7a951a9dc3ec358f1bc25a2beed6c416f432d0
Score

10^/10

spyware trojan stealer lokibot
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Blacklisted process makes network request
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blacklisted process makes network request

Loads dropped DLL

Reads user/profile data of web browsers

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2