lokibot | 87bab2541c2885e0883b4bc127f7e2de4d6de30f3eb0be38ef289bd453c3829b | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
scan-018349_pdf.exe
Size 618KB
Sample201109-psbe3bsxcx
SHA256 87bab2541c2885e0883b4bc127f7e2de4d6de30f3eb0be38ef289bd453c3829b
MD5 218f4efbc380eb283b2a8623b94374d3
SHA1 a2112df3b71a34e72cb6c280a0d193c617f6b66f
SHA512 f902c012f86eaf0e4840f29dda0697713f600a63f5c849bdbf8db141d97ed05f6e092897719e85c9918c502f3482be1e92490d1bc200b65b1bdf4e382c96df9b
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://broken6.cf/LO4/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  scan-018349_pdf.exe
- Size 618KB
- SHA256 87bab2541c2885e0883b4bc127f7e2de4d6de30f3eb0be38ef289bd453c3829b
- MD5 218f4efbc380eb283b2a8623b94374d3
- SHA1 a2112df3b71a34e72cb6c280a0d193c617f6b66f
- SHA512 f902c012f86eaf0e4840f29dda0697713f600a63f5c849bdbf8db141d97ed05f6e092897719e85c9918c502f3482be1e92490d1bc200b65b1bdf4e382c96df9b
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan