lokibot

Sharing

Copy URL

Twitter E-mail

General

Target

2407da1627f35dafc162c06c93c95d612ac0349488241d297152e41d0f8af7a0.exe
Size

1.8MB
Sample

240626-bf94jaxglp
MD5

1af02455b4d35d282469dde4144cbd07
SHA1

bcd8d182b9d8036ce3b31c4fac14cb1d074e45ff
SHA256

2407da1627f35dafc162c06c93c95d612ac0349488241d297152e41d0f8af7a0
SHA512

9ab046b3c20985290f155e07441ea97ac84bc064b8f237b2883cb65280bcf9f0b174924e8e20eb22be5b10693b20be02bdaa3ab4f9e9e79c71ded6f031af8c0a
SSDEEP

49152:mOD+bTI6YTDml4HJPHDQkOBU0f9iygcrxZ3aU5ZdIrRo2ht1K1YvkUw:rv85

Score

10^/10

Malware Config

Extracted

Family

lokibot

http://sssteell-com.pro/kedu/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  2407da1627f35dafc162c06c93c95d612ac0349488241d297152e41d0f8af7a0.exe
- Size
  
  1.8MB
- MD5
  
  1af02455b4d35d282469dde4144cbd07
- SHA1
  
  bcd8d182b9d8036ce3b31c4fac14cb1d074e45ff
- SHA256
  
  2407da1627f35dafc162c06c93c95d612ac0349488241d297152e41d0f8af7a0
- SHA512
  
  9ab046b3c20985290f155e07441ea97ac84bc064b8f237b2883cb65280bcf9f0b174924e8e20eb22be5b10693b20be02bdaa3ab4f9e9e79c71ded6f031af8c0a
- SSDEEP
  
  49152:mOD+bTI6YTDml4HJPHDQkOBU0f9iygcrxZ3aU5ZdIrRo2ht1K1YvkUw:rv85
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects executables containing common artifacts observed in infostealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Detects executables containing common artifacts observed in infostealers

Detects executables referencing many file transfer clients. Observed in information stealers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2