lokibot | 8d72963427e5e1ece6579f890111e0b67da9d14bbb60f8cf5f3dbf8d699df48d | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.Trojan.InjectNET.14.13019.22040
Size 597KB
Sample201223-cjmjet111j
SHA256 8d72963427e5e1ece6579f890111e0b67da9d14bbb60f8cf5f3dbf8d699df48d
MD5 2f0c8a1bb15284bdbbbe38c24a2aa491
SHA1 96286f2a8486f659a4e100c4ceae8e428b80fdad
SHA512 4acb376829c0ffc9c0bc4ef643055b8f18a86dd4afe609c5e8a3da9a19382559ba5aa0acefbde8ec93bb125a48d9b0522098da7605ee607432bbb8eef801df0a
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://begadi.ga/clue/gate.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  SecuriteInfo.com.Trojan.InjectNET.14.13019.22040
- Size 597KB
- SHA256 8d72963427e5e1ece6579f890111e0b67da9d14bbb60f8cf5f3dbf8d699df48d
- MD5 2f0c8a1bb15284bdbbbe38c24a2aa491
- SHA1 96286f2a8486f659a4e100c4ceae8e428b80fdad
- SHA512 4acb376829c0ffc9c0bc4ef643055b8f18a86dd4afe609c5e8a3da9a19382559ba5aa0acefbde8ec93bb125a48d9b0522098da7605ee607432bbb8eef801df0a
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan