lokibot | 2d76841d2096a7c76ba0e1e7905d4231a31caa083a2f2bfc68d5911755ee6043 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
66426dc24f37ef4e687af00701fdbe3f.exe
Size 504KB
Sample201218-cgdwa2z15j
SHA256 2d76841d2096a7c76ba0e1e7905d4231a31caa083a2f2bfc68d5911755ee6043
MD5 66426dc24f37ef4e687af00701fdbe3f
SHA1 795dff01dc8fdb634684b8c861785aedcb474714
SHA512 930faaa68ec50bf605bc4f79cfd173649b80c789aaf259969a4b6bb896c36ee752d33d28a752c8846e2523216e5e5202bf90c2b9bd2d5802cad29fa4ebbe37c2
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://begadi.ga/chud/gate.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  66426dc24f37ef4e687af00701fdbe3f.exe
- Size 504KB
- SHA256 2d76841d2096a7c76ba0e1e7905d4231a31caa083a2f2bfc68d5911755ee6043
- MD5 66426dc24f37ef4e687af00701fdbe3f
- SHA1 795dff01dc8fdb634684b8c861785aedcb474714
- SHA512 930faaa68ec50bf605bc4f79cfd173649b80c789aaf259969a4b6bb896c36ee752d33d28a752c8846e2523216e5e5202bf90c2b9bd2d5802cad29fa4ebbe37c2
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan