lokibot

General

Target

SecuriteInfo.com.Trojan.PWS.Siggen2.52076.22337.3297
Size

196KB
Sample

200802-63xgm47t22
MD5

c8622061c2330af588df35ae3e0d970b
SHA1

36bdf9909e56aa37d05fc664286a79fa25b9dbd6
SHA256

ed3f7ab84c2988036a63e375a5fc9f98dff31fd2a9597b4eae79604ae622e6cd
SHA512

e48007d08efe2ea5b4b5defbbcce78f9219aa16209e2ab4f44403020c58aaba0c8b0acd93c87e40e2595c3a3fe24e124564a1b4ed62caf0debebb8bd858453b6

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://mecharnise.ir/ea5/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  SecuriteInfo.com.Trojan.PWS.Siggen2.52076.22337.3297
- Size
  
  196KB
- MD5
  
  c8622061c2330af588df35ae3e0d970b
- SHA1
  
  36bdf9909e56aa37d05fc664286a79fa25b9dbd6
- SHA256
  
  ed3f7ab84c2988036a63e375a5fc9f98dff31fd2a9597b4eae79604ae622e6cd
- SHA512
  
  e48007d08efe2ea5b4b5defbbcce78f9219aa16209e2ab4f44403020c58aaba0c8b0acd93c87e40e2595c3a3fe24e124564a1b4ed62caf0debebb8bd858453b6
Score

10^/10

spyware trojan stealer lokibot
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2