lokibot | f6f59d39a6bfeb7e23f3340db9812c67c32ceafaf2bed99f92973a8c07c4c174 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
eInvoicing_pdf.exe
Size 647KB
Sample201105-whmkvep9hs
SHA256 f6f59d39a6bfeb7e23f3340db9812c67c32ceafaf2bed99f92973a8c07c4c174
MD5 86903136ce1cda51f325214638805b6a
SHA1 2188fef833b6227e5b4a2403515afaaba4f819d7
SHA512 11f0645b62412142bac18304aae56e6145e27e0e83fa52906e39466f29e42b4e6d0d99753feb8ab3599f8901452b86be507d3649f548e19d922c4607a8d6e691
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://195.69.140.147/.op/cr.php/1nktOrlTZf6Jf
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  eInvoicing_pdf.exe
- Size 647KB
- SHA256 f6f59d39a6bfeb7e23f3340db9812c67c32ceafaf2bed99f92973a8c07c4c174
- MD5 86903136ce1cda51f325214638805b6a
- SHA1 2188fef833b6227e5b4a2403515afaaba4f819d7
- SHA512 11f0645b62412142bac18304aae56e6145e27e0e83fa52906e39466f29e42b4e6d0d99753feb8ab3599f8901452b86be507d3649f548e19d922c4607a8d6e691
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan