lokibot | 8b5e85a9b8c23b7862d328ae2b980c0fb20acb0fff8e950dfa98d7fb77eecef6 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
4500008258.exe
Size 775KB
Sample201103-6x18nc6tee
SHA256 8b5e85a9b8c23b7862d328ae2b980c0fb20acb0fff8e950dfa98d7fb77eecef6
MD5 e41145baa54780d0a8a46d55e98c9742
SHA1 d85ca2e5ef3bc97040a8bc08dd9f0e99502e3784
SHA512 ba0ed34d3d3c1f8cd241c9522cb218f5f348e99916a7ef07a952c37837c60f31a57be896fee6ad770222ac66290def31a9df95c580f3733e39686deee213930d
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://mecharnise.ir/eb2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  4500008258.exe
- Size 775KB
- SHA256 8b5e85a9b8c23b7862d328ae2b980c0fb20acb0fff8e950dfa98d7fb77eecef6
- MD5 e41145baa54780d0a8a46d55e98c9742
- SHA1 d85ca2e5ef3bc97040a8bc08dd9f0e99502e3784
- SHA512 ba0ed34d3d3c1f8cd241c9522cb218f5f348e99916a7ef07a952c37837c60f31a57be896fee6ad770222ac66290def31a9df95c580f3733e39686deee213930d
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan