lokibot | 429cba445e3970b4730fe186da96afff8106dfed7e3a70d45db5b3364fdadaa2 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
opi.exe
Size 563KB
Sample201109-nxa8468fea
SHA256 429cba445e3970b4730fe186da96afff8106dfed7e3a70d45db5b3364fdadaa2
MD5 8f61f8df0537f8b2befc697c309379bf
SHA1 a6e610b627ebc0bbf81f77301e06cc36aa6b1fce
SHA512 0f9a6649c36bbb28b02a93edbfd6f2ba7f7e2aa9ea7aa792411aeda51a74cda560892334daeeb7a29ac75fae5b6472a5755f016eb35a02843a315f28ec871d80
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://kerenzohar.co.il/sit/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  opi.exe
- Size 563KB
- SHA256 429cba445e3970b4730fe186da96afff8106dfed7e3a70d45db5b3364fdadaa2
- MD5 8f61f8df0537f8b2befc697c309379bf
- SHA1 a6e610b627ebc0bbf81f77301e06cc36aa6b1fce
- SHA512 0f9a6649c36bbb28b02a93edbfd6f2ba7f7e2aa9ea7aa792411aeda51a74cda560892334daeeb7a29ac75fae5b6472a5755f016eb35a02843a315f28ec871d80
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan