lokibot | 5895f5fabc547b0085b8f6d77c7ee281e78b37a27e64dde09ae0ce84685efd9c | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
tttttttttttttttttttt.exe
Size 889KB
Sample201109-742fms3t76
SHA256 5895f5fabc547b0085b8f6d77c7ee281e78b37a27e64dde09ae0ce84685efd9c
MD5 6446f027529a625c28479b1d79617d7d
SHA1 094963483b9bd29765fe28856a991668a1d62c6e
SHA512 cfc20125f1d41900205dc548062f9e5cd999e3c36a47becfcd714c02d340c7f2faa1d690522be41ef708c6ffb1a67df5a946f7be28bdc525b3af2a44f83ecb4b
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

https://yaliapartotel.com/2w/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  tttttttttttttttttttt.exe
- Size 889KB
- SHA256 5895f5fabc547b0085b8f6d77c7ee281e78b37a27e64dde09ae0ce84685efd9c
- MD5 6446f027529a625c28479b1d79617d7d
- SHA1 094963483b9bd29765fe28856a991668a1d62c6e
- SHA512 cfc20125f1d41900205dc548062f9e5cd999e3c36a47becfcd714c02d340c7f2faa1d690522be41ef708c6ffb1a67df5a946f7be28bdc525b3af2a44f83ecb4b
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan