lokibot | 0ea9a1325e5cee80f559671e5eb244320f9e86cde7f3bfb98886dc4950d6002e | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
05_INV WT0511_YELLOWFIN LOIN.exe
Size 762KB
Sample201103-ayfymwlk9s
SHA256 0ea9a1325e5cee80f559671e5eb244320f9e86cde7f3bfb98886dc4950d6002e
MD5 122a0a77bd430b17a04b060264339b4f
SHA1 3bf1d6a62b266e5b9e490c652838cbffe588da34
SHA512 52b88be0a1f66a6b9448ffa5cccb19653bc6794941ff1ae48d2da96abe8c0ec6f05981d4c9e36a6447c4b79d19a787c818220e9865e44a7c972ccafebb245186
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://1filesharing.ga/memz/gate.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  05_INV WT0511_YELLOWFIN LOIN.exe
- Size 762KB
- SHA256 0ea9a1325e5cee80f559671e5eb244320f9e86cde7f3bfb98886dc4950d6002e
- MD5 122a0a77bd430b17a04b060264339b4f
- SHA1 3bf1d6a62b266e5b9e490c652838cbffe588da34
- SHA512 52b88be0a1f66a6b9448ffa5cccb19653bc6794941ff1ae48d2da96abe8c0ec6f05981d4c9e36a6447c4b79d19a787c818220e9865e44a7c972ccafebb245186
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan