lokibot | 47cd254d9e0104e8fbe51d35b06c2e250c8af9d6896702f88c793eaeda58bd18 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
28a87a0f28003beb5543d8a4f9b38591.exe
Size 434KB
Sample201112-cllt3q5qds
SHA256 47cd254d9e0104e8fbe51d35b06c2e250c8af9d6896702f88c793eaeda58bd18
MD5 28a87a0f28003beb5543d8a4f9b38591
SHA1 e31fb5b694f1a61a0845a0fa4d6d733c09e8b9ae
SHA512 5c2ccb3deaeb4ad7fdee559ff009890acbffc4294fd05814fa397bd734c02aa7fd9e6acbab618f62a1fb9bbd9e40d525030e712d5518b80f2a873f6e6eca36f3
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

https://microdots.in/panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  28a87a0f28003beb5543d8a4f9b38591.exe
- Size 434KB
- SHA256 47cd254d9e0104e8fbe51d35b06c2e250c8af9d6896702f88c793eaeda58bd18
- MD5 28a87a0f28003beb5543d8a4f9b38591
- SHA1 e31fb5b694f1a61a0845a0fa4d6d733c09e8b9ae
- SHA512 5c2ccb3deaeb4ad7fdee559ff009890acbffc4294fd05814fa397bd734c02aa7fd9e6acbab618f62a1fb9bbd9e40d525030e712d5518b80f2a873f6e6eca36f3
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan