lokibot

General

Target
swift.xlsx
Size 223KB
Sample220516-h28adsfed7
SHA256 85a3337570282d52fffcf91b2cbf5e8064a81265beffa155baba6ca8d6ac2993
MD5 f151564283ab534fb2a0bf71d9a6ff2d
SHA1 cb38295acb4130c7b03aa3959ea139b94d99cafd
SHA512 3d586835c86a84fa9c39a9afbb4002a405274a4ed2b44183bb8dfa71045b87be8994f0905948d9b26388eb5f7f4fb1f056813a204895d76c6810a36a6762e458
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://45.133.1.20/healthone/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  swift.xlsx
- Size 223KB
- SHA256 85a3337570282d52fffcf91b2cbf5e8064a81265beffa155baba6ca8d6ac2993
- MD5 f151564283ab534fb2a0bf71d9a6ff2d
- SHA1 cb38295acb4130c7b03aa3959ea139b94d99cafd
- SHA512 3d586835c86a84fa9c39a9afbb4002a405274a4ed2b44183bb8dfa71045b87be8994f0905948d9b26388eb5f7f4fb1f056813a204895d76c6810a36a6762e458
- MD5 SHA1 SHA512
Score

10^/10

lokibot collection spyware stealer suricata trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
  suricata
- suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
  suricata
- suricata: ET MALWARE LokiBot Checkin
  suricata: ET MALWARE LokiBot Checkin
  suricata
- suricata: ET MALWARE LokiBot Fake 404 Response
  suricata: ET MALWARE LokiBot Fake 404 Response
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
  suricata
- suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
  suricata
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
  suricata
- suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016
  suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016
  suricata
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2