lokibot | c844f3484e31450c39372bcc19ebc94bcff258fd03e8a59edf7b3acc3c91682a | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ZJ6acgnEEcphF6n.exe
Size 448KB
Sample201224-c4myzescyx
SHA256 c844f3484e31450c39372bcc19ebc94bcff258fd03e8a59edf7b3acc3c91682a
MD5 0d1720971a5e9b59cfaec7984f29ab71
SHA1 ddbae5f05061bfb66aaaf66cb54d41965614991b
SHA512 5ae5a2e0151c87e1e345d139c49360e63da26952ca35ef1db41886f98aa151e3b83e14b8d5af2a6ed313b5e54c720fed4003d3c91a92c11f8bbed7e40e90c61c
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://azzmtool.com/kin/kin1/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  ZJ6acgnEEcphF6n.exe
- Size 448KB
- SHA256 c844f3484e31450c39372bcc19ebc94bcff258fd03e8a59edf7b3acc3c91682a
- MD5 0d1720971a5e9b59cfaec7984f29ab71
- SHA1 ddbae5f05061bfb66aaaf66cb54d41965614991b
- SHA512 5ae5a2e0151c87e1e345d139c49360e63da26952ca35ef1db41886f98aa151e3b83e14b8d5af2a6ed313b5e54c720fed4003d3c91a92c11f8bbed7e40e90c61c
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan