Lokibot

Malware & Tools · Lokibot

· MalwareS0447 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

Lokibot is a widely distributed information stealer that was first reported in 2015. It is designed to steal sensitive information such as usernames, passwords, cryptocurrency wallets, and other credentials. Lokibot can also create a backdoor into infected systems to allow an attacker to install additional payloads.(Citation: Infoblox Lokibot January 2019)(Citation: Morphisec Lokibot April 2020)(Citation: CISA Lokibot September 2020)

Tactic Coverage

stealth (8)execution (7)discovery (5)privilege escalation (4)persistence (3)credential access (3)command and control (2)exfiltration (1)collection (1)defense impairment (1)initial access (1)

Used By (1 groups)

G0083SilverTerrier

Techniques (28)

T1016System Network Configuration Discovery

discovery

T1027Obfuscated Files or Information

stealth

T1027.002Software Packing

stealth

T1033System Owner/User Discovery

discovery

T1041Exfiltration Over C2 Channel

exfiltration

T1053Scheduled Task/Job

executionpersistence

References

https://attack.mitre.org/software/S0447 https://insights.infoblox.com/threat-intelligence-reports/threat-intelligence--22 https://blog.morphisec.com/lokibot-with-autoit-obfuscator-frenchy-shellcode https://us-cert.cisa.gov/ncas/alerts/aa20-266a https://blog.talosintelligence.com/2021/01/a-deep-dive-into-lokibot-infection-chain.html