lokibot

General

Target
551b922ffeac1a93a892a5b15f4465ee.exe
Size 432KB
Sample220107-jnpfsscaa5
SHA256 b1090fca7443fd9d5fae0f8490badf5676aeb2f79b0a08e6cb3b299d7c4fc4f2
MD5 551b922ffeac1a93a892a5b15f4465ee
SHA1 f7efc393d7c2fe3031125ebf0227a1a58870812f
SHA512 8a5ced8ac0386ac2ca9c5595c664cff0f31d7cc58891abfc8b4ab0bcd8d1cbb066e6dbaf65c68a06024d4d656a8fb76643cafa97832a8f9e311e62b2504d185b
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://secure01-redirect.net/gc5/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  551b922ffeac1a93a892a5b15f4465ee.exe
- Size 432KB
- SHA256 b1090fca7443fd9d5fae0f8490badf5676aeb2f79b0a08e6cb3b299d7c4fc4f2
- MD5 551b922ffeac1a93a892a5b15f4465ee
- SHA1 f7efc393d7c2fe3031125ebf0227a1a58870812f
- SHA512 8a5ced8ac0386ac2ca9c5595c664cff0f31d7cc58891abfc8b4ab0bcd8d1cbb066e6dbaf65c68a06024d4d656a8fb76643cafa97832a8f9e311e62b2504d185b
- MD5 SHA1 SHA512
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2