lokibot | 9f353c5d907133307b1ac1addf1a8cdce88fd5dbabe5b17005247ccf46cb71dc | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cordAjSW4hLNpmf.exe
Size 637KB
Sample210107-mc9w979a3e
SHA256 9f353c5d907133307b1ac1addf1a8cdce88fd5dbabe5b17005247ccf46cb71dc
MD5 d4973d60ae852b4eb1dd03bfce9e9012
SHA1 7d2eb354813f61eb4ae2533ac3c4125039f2d306
SHA512 2aa2d27736f16fca4cd8d18847821121418d2f7052ce18475425dccc561887a12e763bb35f52e681d2ae7df4408df09cecc36f31cd6d786c9d606c694ef7e16f
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://azzmtool.com/kin/kin1/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  cordAjSW4hLNpmf.exe
- Size 637KB
- SHA256 9f353c5d907133307b1ac1addf1a8cdce88fd5dbabe5b17005247ccf46cb71dc
- MD5 d4973d60ae852b4eb1dd03bfce9e9012
- SHA1 7d2eb354813f61eb4ae2533ac3c4125039f2d306
- SHA512 2aa2d27736f16fca4cd8d18847821121418d2f7052ce18475425dccc561887a12e763bb35f52e681d2ae7df4408df09cecc36f31cd6d786c9d606c694ef7e16f
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan