lokibot

General

Target

4930505aa3f93d1a2208358ebe555b87c16222da150fd728c2a92f1d0dcf774f.exe
Size

604KB
Sample

201205-t33ed9dcyn
MD5

5e90cbe0ca793c5f2f41b38efd18e063
SHA1

82cb121be4fe27f2c686eb2491f068e8577f5de7
SHA256

4930505aa3f93d1a2208358ebe555b87c16222da150fd728c2a92f1d0dcf774f
SHA512

302d6401959105e5009fc585002bf0a950d50e397a42ed8e15be82376b57897ab2d741e1df591c9e7fa32e8bc5aad7a08fa3fa6f62fcfec0cb16d996c645398e

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://185.239.242.195/po1/1/cgi.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  4930505aa3f93d1a2208358ebe555b87c16222da150fd728c2a92f1d0dcf774f.exe
- Size
  
  604KB
- MD5
  
  5e90cbe0ca793c5f2f41b38efd18e063
- SHA1
  
  82cb121be4fe27f2c686eb2491f068e8577f5de7
- SHA256
  
  4930505aa3f93d1a2208358ebe555b87c16222da150fd728c2a92f1d0dcf774f
- SHA512
  
  302d6401959105e5009fc585002bf0a950d50e397a42ed8e15be82376b57897ab2d741e1df591c9e7fa32e8bc5aad7a08fa3fa6f62fcfec0cb16d996c645398e
Score

10^/10

lokibot persistence spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2