lokibot | 2bb336ebba409e0d8d531887fb7ab32219639bb130159ee4da89b2ca94fe76d9 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Remittance Advice_pdf.exe
Size 745KB
Sample201119-6c7eh8b96e
SHA256 2bb336ebba409e0d8d531887fb7ab32219639bb130159ee4da89b2ca94fe76d9
MD5 5b672e6f408f3f49f4be602ee7d16105
SHA1 d5547862a1f7926191a790eda4318f643c2e8eeb
SHA512 7a48051c4bd5e2e1a89db7f654b3905dfaa6d16853d84742e4c89acf513cc56244af41ea56504f77cff69f041cadc8e43b48f2877d26e45c8219ec25728cdc0d
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://firnabulking.com/class/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  Remittance Advice_pdf.exe
- Size 745KB
- SHA256 2bb336ebba409e0d8d531887fb7ab32219639bb130159ee4da89b2ca94fe76d9
- MD5 5b672e6f408f3f49f4be602ee7d16105
- SHA1 d5547862a1f7926191a790eda4318f643c2e8eeb
- SHA512 7a48051c4bd5e2e1a89db7f654b3905dfaa6d16853d84742e4c89acf513cc56244af41ea56504f77cff69f041cadc8e43b48f2877d26e45c8219ec25728cdc0d
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan