lokibot | 25aaaf18e2bd8f09ed33157220bfbfbf02ba8387a0439eee6c908439a663ec48 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
LV_BALTTRA_202012LTD.exe
Size 1.1MB
Sample201109-6ll1bpmdyn
SHA256 25aaaf18e2bd8f09ed33157220bfbfbf02ba8387a0439eee6c908439a663ec48
MD5 ea519dcf0455ac35ce7acef948a31c64
SHA1 539fddc8f6ed5e6ad1bda6966171c6d05cf4e3fc
SHA512 f4303b81a93a083afe25245c2cbf6104834b5a11180835353b16c754ac933ef4782f7efa39ca628e8534574a04562da1986d834f746ba058734cc20769ffe0f7
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://198.23.200.239/~boxing/.tcsogb/gi'v.php/sz3iEUXzHMQ3c
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  LV_BALTTRA_202012LTD.exe
- Size 1.1MB
- SHA256 25aaaf18e2bd8f09ed33157220bfbfbf02ba8387a0439eee6c908439a663ec48
- MD5 ea519dcf0455ac35ce7acef948a31c64
- SHA1 539fddc8f6ed5e6ad1bda6966171c6d05cf4e3fc
- SHA512 f4303b81a93a083afe25245c2cbf6104834b5a11180835353b16c754ac933ef4782f7efa39ca628e8534574a04562da1986d834f746ba058734cc20769ffe0f7
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan