lokibot | 4db2ee4d726918d796e795d55b057e6a34b2b9645395eec7c91d8d139150c64f | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
4db2ee4d726918d796e795d55b057e6a34b2b9645395eec7c91d8d139150c64f
Size 704KB
Sample201114-grad8p5fs2
SHA256 4db2ee4d726918d796e795d55b057e6a34b2b9645395eec7c91d8d139150c64f
MD5 3716a2c93da0c1f36a5cb1b6a8e7ec7f
SHA1 fd10c96700d4df82c5f8c9e7fad44ef796e4a473
SHA512 103aa5a150362d582b8a8edc7ce0ecbea9d031aae585a1d05928296ea26cc1d33a6fd56ea376c47c7169ad354edf1618789c06e4f10b23f2ee2757d512ad8010
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://mecharnise.ir/eb2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  4db2ee4d726918d796e795d55b057e6a34b2b9645395eec7c91d8d139150c64f
- Size 704KB
- SHA256 4db2ee4d726918d796e795d55b057e6a34b2b9645395eec7c91d8d139150c64f
- MD5 3716a2c93da0c1f36a5cb1b6a8e7ec7f
- SHA1 fd10c96700d4df82c5f8c9e7fad44ef796e4a473
- SHA512 103aa5a150362d582b8a8edc7ce0ecbea9d031aae585a1d05928296ea26cc1d33a6fd56ea376c47c7169ad354edf1618789c06e4f10b23f2ee2757d512ad8010
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan