lokibot | 6c0612e71239972d92121249145948eec8ccfab90e1e47d0337fabccaaa5ade2 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PO#499039.exe
Size 1.7MB
Sample201028-mvb8wfk3c6
SHA256 6c0612e71239972d92121249145948eec8ccfab90e1e47d0337fabccaaa5ade2
MD5 e3965bf545237286d3c252bd368f4488
SHA1 34109656ecf5616aac87bd2da4e733de44356257
SHA512 2e8b47702803414a510c8dd26c549c87f70d0ecf35c3c326dfa0ca88b1f846ec0a6fcd5fe731c4dd93d7be503c19a80283a13531f0166ffc5ad4206704b08a1f
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://192.236.147.197/bg/dope/ltd.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  PO#499039.exe
- Size 1.7MB
- SHA256 6c0612e71239972d92121249145948eec8ccfab90e1e47d0337fabccaaa5ade2
- MD5 e3965bf545237286d3c252bd368f4488
- SHA1 34109656ecf5616aac87bd2da4e733de44356257
- SHA512 2e8b47702803414a510c8dd26c549c87f70d0ecf35c3c326dfa0ca88b1f846ec0a6fcd5fe731c4dd93d7be503c19a80283a13531f0166ffc5ad4206704b08a1f
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan