lokibot | 3eb7b4baf0f3d7c432ad06fb577907e64e8387894289bbfc04bfd2e8f9891f16 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ABRECHNUNGSRECHNUNG 267000863645.PPTXL.gz.exe
Size 296KB
Sample201130-ghp5b3abda
SHA256 3eb7b4baf0f3d7c432ad06fb577907e64e8387894289bbfc04bfd2e8f9891f16
MD5 e4aed5c4082b94eb7cedec454e756a60
SHA1 17ae501620ddfd7659bf05b036f6402b60898bfb
SHA512 db20adf3b87876dfe14cf52e7b248cf14904caf3d2ee1ccf2415f98f39b979e9a092b5314b705e0aed7cf60760be9db69851306136ec52bcd1b8b3f248df9d0d
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://104.168.146.103/MegAMOneyMenINTurkey/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  ABRECHNUNGSRECHNUNG 267000863645.PPTXL.gz.exe
- Size 296KB
- SHA256 3eb7b4baf0f3d7c432ad06fb577907e64e8387894289bbfc04bfd2e8f9891f16
- MD5 e4aed5c4082b94eb7cedec454e756a60
- SHA1 17ae501620ddfd7659bf05b036f6402b60898bfb
- SHA512 db20adf3b87876dfe14cf52e7b248cf14904caf3d2ee1ccf2415f98f39b979e9a092b5314b705e0aed7cf60760be9db69851306136ec52bcd1b8b3f248df9d0d
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan