lokibot | cec0ddc9d5b7baa3df66a726727d0a0ae977f112f5671d0be4580d22148d5ee3 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
57f70f5f34b309b444bc08eb765e353e.exe
Size 490KB
Sample201210-s324sp9ftn
SHA256 cec0ddc9d5b7baa3df66a726727d0a0ae977f112f5671d0be4580d22148d5ee3
MD5 57f70f5f34b309b444bc08eb765e353e
SHA1 078f89ba364e7f7f62d6bad57383349f90943e4b
SHA512 e16641b025c7d51e858885f0374c65ba943d4d2ff5483ee848e49ba680d050985ec099a89810b7893fac932732a027724308a2fb43a6e641d468a374b6b5c613
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://forrastfoods.com/candy/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  57f70f5f34b309b444bc08eb765e353e.exe
- Size 490KB
- SHA256 cec0ddc9d5b7baa3df66a726727d0a0ae977f112f5671d0be4580d22148d5ee3
- MD5 57f70f5f34b309b444bc08eb765e353e
- SHA1 078f89ba364e7f7f62d6bad57383349f90943e4b
- SHA512 e16641b025c7d51e858885f0374c65ba943d4d2ff5483ee848e49ba680d050985ec099a89810b7893fac932732a027724308a2fb43a6e641d468a374b6b5c613
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan