lokibot | c6d32cce563241de2f9137ed8a1812a2413cbed6f84d4d6870202fa0fcd1e01e | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
TNT Numero.exe
Size 768KB
Sample201118-dmshm4ypwx
SHA256 c6d32cce563241de2f9137ed8a1812a2413cbed6f84d4d6870202fa0fcd1e01e
MD5 4bec0e239719badf1df30f9913ce2d29
SHA1 f43f447a4991fc80059803ce81e5728dc315be03
SHA512 92cd07ac99dd8e758309afc9f42247d84c5cadaf6c252c0f9daa9f367d8db8b8c7a840775fd710fe87883aa804bd82f56041ddec31e8ac36a684243ffe160aef
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://legalpath.in/cc/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  TNT Numero.exe
- Size 768KB
- SHA256 c6d32cce563241de2f9137ed8a1812a2413cbed6f84d4d6870202fa0fcd1e01e
- MD5 4bec0e239719badf1df30f9913ce2d29
- SHA1 f43f447a4991fc80059803ce81e5728dc315be03
- SHA512 92cd07ac99dd8e758309afc9f42247d84c5cadaf6c252c0f9daa9f367d8db8b8c7a840775fd710fe87883aa804bd82f56041ddec31e8ac36a684243ffe160aef
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan