lokibot | 1d5b2bf5d577a2d6cc344c59958e69b3bdbbae5f11acebfc27a2e392c38c5f71 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.Trojan.InjectNET.14.27303.9121
Size 377KB
Sample201215-cc5pnsbw7a
SHA256 1d5b2bf5d577a2d6cc344c59958e69b3bdbbae5f11acebfc27a2e392c38c5f71
MD5 ebc762f4d1d6557fcfb73fc7eb1d5b7a
SHA1 21b1f4485c596dbecdddf2288fd1a4fce24fec0f
SHA512 d75784c654bfbb150c84032383aff9cad0582f4d97810b028a2b1c2a585ed387e2ef1b0cfdc4da911bad140cf927b197a2c2a78519a06def82754e56a15d7fce
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://benweve.com/clock/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  SecuriteInfo.com.Trojan.InjectNET.14.27303.9121
- Size 377KB
- SHA256 1d5b2bf5d577a2d6cc344c59958e69b3bdbbae5f11acebfc27a2e392c38c5f71
- MD5 ebc762f4d1d6557fcfb73fc7eb1d5b7a
- SHA1 21b1f4485c596dbecdddf2288fd1a4fce24fec0f
- SHA512 d75784c654bfbb150c84032383aff9cad0582f4d97810b028a2b1c2a585ed387e2ef1b0cfdc4da911bad140cf927b197a2c2a78519a06def82754e56a15d7fce
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

lokibotspywarestealertrojan