lokibot | e15df89f3c40de3f56a2bde5737c9b22ce162dbe2e098dce6a3e7126d707ddb7 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
b8561eed84f227c88c7b8d3a106be5ab.exe
Size 569KB
Sample201214-t84gr9qkbj
SHA256 e15df89f3c40de3f56a2bde5737c9b22ce162dbe2e098dce6a3e7126d707ddb7
MD5 b8561eed84f227c88c7b8d3a106be5ab
SHA1 3a13f71a25ee51404402f49fee62b54c6b1ded9a
SHA512 1b7f7139d6e0be89817c6da7852c9c9bc2890566b5b9c96ceae705614ee6e76dad8dc29b8709c378c7ff61c3835cc419012cecf3c0b5ffdc005ec159b6bffb49
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://webtex.ga/rojas/gate.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  b8561eed84f227c88c7b8d3a106be5ab.exe
- Size 569KB
- SHA256 e15df89f3c40de3f56a2bde5737c9b22ce162dbe2e098dce6a3e7126d707ddb7
- MD5 b8561eed84f227c88c7b8d3a106be5ab
- SHA1 3a13f71a25ee51404402f49fee62b54c6b1ded9a
- SHA512 1b7f7139d6e0be89817c6da7852c9c9bc2890566b5b9c96ceae705614ee6e76dad8dc29b8709c378c7ff61c3835cc419012cecf3c0b5ffdc005ec159b6bffb49
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan