lokibot | 690e6eabcc269b5c5a1d27e4bce683d71a3ef5124401d6c464fd1a2935a3e577 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
INV10228552.exe
Size 587KB
Sample201109-1rfmlk4kb6
SHA256 690e6eabcc269b5c5a1d27e4bce683d71a3ef5124401d6c464fd1a2935a3e577
MD5 9b1da0d410a48abcdc29930250b4805f
SHA1 7f7bb86389a3828aa0ef134da0c5105eca9ac407
SHA512 dc773293bb64f540d87e436333ce67c552de5dd11324c70f75b31b851c7f25be7fe1c7b27f11da96451f39a5225a4b4ab2d4753b804302af92875682a42ed583
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://rnarport.com/dull/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  INV10228552.exe
- Size 587KB
- SHA256 690e6eabcc269b5c5a1d27e4bce683d71a3ef5124401d6c464fd1a2935a3e577
- MD5 9b1da0d410a48abcdc29930250b4805f
- SHA1 7f7bb86389a3828aa0ef134da0c5105eca9ac407
- SHA512 dc773293bb64f540d87e436333ce67c552de5dd11324c70f75b31b851c7f25be7fe1c7b27f11da96451f39a5225a4b4ab2d4753b804302af92875682a42ed583
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan