lokibot | 508bdc3668fe3bd2512d398615e6ff998e3df2b9bee88e16725be7f8d5e8db6e | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Canon Invoice - SG191009 & SG191008-pdf.exe
Size 712KB
Sample201120-a4a2vv7jh2
SHA256 508bdc3668fe3bd2512d398615e6ff998e3df2b9bee88e16725be7f8d5e8db6e
MD5 1af58451c187ceee9f662950497814de
SHA1 40687552b3159e365dc809a5c11d967f28660831
SHA512 52e04b0cf72d394e626aa91d633babc37cdf10779233b3a7b60d5a699586cdb40df606da7e28c78c60e789960c8efe8491e367826b0ba5d3fe1f89be986cd977
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://firnabulking.com/class/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  Canon Invoice - SG191009 & SG191008-pdf.exe
- Size 712KB
- SHA256 508bdc3668fe3bd2512d398615e6ff998e3df2b9bee88e16725be7f8d5e8db6e
- MD5 1af58451c187ceee9f662950497814de
- SHA1 40687552b3159e365dc809a5c11d967f28660831
- SHA512 52e04b0cf72d394e626aa91d633babc37cdf10779233b3a7b60d5a699586cdb40df606da7e28c78c60e789960c8efe8491e367826b0ba5d3fe1f89be986cd977
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan