lokibot | 1df38ad7f7297914ac4345c3572a92bd2a0507baedff37681f35b3bb8fa0d9eb | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PO 041120-041A.exe
Size 599KB
Sample201104-d3248hjnae
SHA256 1df38ad7f7297914ac4345c3572a92bd2a0507baedff37681f35b3bb8fa0d9eb
MD5 d7d02eff717f24192284c840389d4b1d
SHA1 52b4545feafdb9e4a2f6d9f87c660c46913a75a9
SHA512 069cfbd968eb9ef5a97d174a933f26f3f5267ac55e21aca700cd398c5776a24f0d4bea542fab4b1b4146a58cf7224f667445cac89c3fb75b6740561a884ec1c1
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://79.124.8.8/plesk-site-preview/heliopoliss.com/http/79.124.8.8/kiriko/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  PO 041120-041A.exe
- Size 599KB
- SHA256 1df38ad7f7297914ac4345c3572a92bd2a0507baedff37681f35b3bb8fa0d9eb
- MD5 d7d02eff717f24192284c840389d4b1d
- SHA1 52b4545feafdb9e4a2f6d9f87c660c46913a75a9
- SHA512 069cfbd968eb9ef5a97d174a933f26f3f5267ac55e21aca700cd398c5776a24f0d4bea542fab4b1b4146a58cf7224f667445cac89c3fb75b6740561a884ec1c1
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan