lokibot | 503c4213cf8547c3e4f31c34bd75960f9f2e2ba40a37ad7ca2e06e52229e44e5 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PO.exe
Size 1.1MB
Sample201217-r52p8ktet6
SHA256 503c4213cf8547c3e4f31c34bd75960f9f2e2ba40a37ad7ca2e06e52229e44e5
MD5 11670b9da96d3004eb515fa1b20962fc
SHA1 658f58152e49203325b1f1f9fb58905514b1db9a
SHA512 57086ab9ea6ac4858fc2787013965688fc5f250addfa4e31aa3c23e9629f95c34d2a1354bf0e8e1f2cc194c68ec8754973c70d747f0285ab4945582ec63a4203
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://oziltestfw.ml/officem10/logs/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  PO.exe
- Size 1.1MB
- SHA256 503c4213cf8547c3e4f31c34bd75960f9f2e2ba40a37ad7ca2e06e52229e44e5
- MD5 11670b9da96d3004eb515fa1b20962fc
- SHA1 658f58152e49203325b1f1f9fb58905514b1db9a
- SHA512 57086ab9ea6ac4858fc2787013965688fc5f250addfa4e31aa3c23e9629f95c34d2a1354bf0e8e1f2cc194c68ec8754973c70d747f0285ab4945582ec63a4203
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan