lokibot | 59ec86c8b18a331a2679a555114120a087f3eddfb828dd815fd09748ed9e8403 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
order (076_20_186).exe
Size 1.0MB
Sample201218-5f13asp6kx
SHA256 59ec86c8b18a331a2679a555114120a087f3eddfb828dd815fd09748ed9e8403
MD5 6d75ee651594004f9e21da4ff9b498c9
SHA1 b024ed0f39ae4731d3bd97ed8046248b906b2199
SHA512 14d3e6175604202e20f99e6087749353ce358901fc52fc7913cbcebb4dcaed67061fcf8abce324daa02a162522215be61de6003f7f0ba069689b76c5da218f8b
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://tradesgroups.com/bin/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  order (076_20_186).exe
- Size 1.0MB
- SHA256 59ec86c8b18a331a2679a555114120a087f3eddfb828dd815fd09748ed9e8403
- MD5 6d75ee651594004f9e21da4ff9b498c9
- SHA1 b024ed0f39ae4731d3bd97ed8046248b906b2199
- SHA512 14d3e6175604202e20f99e6087749353ce358901fc52fc7913cbcebb4dcaed67061fcf8abce324daa02a162522215be61de6003f7f0ba069689b76c5da218f8b
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan