lokibot | c224d671ef8ea5bfdc03b9a33d7ae043827b83c2ddc96e7ce128efb36f26fb9e | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
EIKODO_PURCHASE-ORDER-MAY.exe
Size 1.4MB
Sample201109-ye4hhbwrma
SHA256 c224d671ef8ea5bfdc03b9a33d7ae043827b83c2ddc96e7ce128efb36f26fb9e
MD5 0277b9d4e3a1da6a501acfde1777ba82
SHA1 bad9604e63ed6bbcc4697b163b01cdecb9db6255
SHA512 8b2918c4093c877379f9d49ae86b8c0e504975cb4db889114777a0ff67d3a2234c39e879b1a7a8373781c560fb5036abb8665131949d401a3f6b022ac1ebbbfb
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://oneflextiank.com/click/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  EIKODO_PURCHASE-ORDER-MAY.exe
- Size 1.4MB
- SHA256 c224d671ef8ea5bfdc03b9a33d7ae043827b83c2ddc96e7ce128efb36f26fb9e
- MD5 0277b9d4e3a1da6a501acfde1777ba82
- SHA1 bad9604e63ed6bbcc4697b163b01cdecb9db6255
- SHA512 8b2918c4093c877379f9d49ae86b8c0e504975cb4db889114777a0ff67d3a2234c39e879b1a7a8373781c560fb5036abb8665131949d401a3f6b022ac1ebbbfb
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan