lokibot | e598d09eb75436c41fd667d85213895ce5dd4903474c5bc38a797e725a75d2e3 | Triage

Sharing

General

Target

e598d09eb75436c41fd667d85213895ce5dd4903474c5bc38a797e725a75d2e3.exe
Size

155KB
Sample

210113-dm1q3433yx
MD5

ce3ff26ad43b8f74c6face5a1c49f498
SHA1

e90a6530271fc1cc61be9577b007d4c0af9bc8dd
SHA256

e598d09eb75436c41fd667d85213895ce5dd4903474c5bc38a797e725a75d2e3
SHA512

8f42be57b412bfbfc11de863770ba6c2f2a7fc7ed40c3778a74f72d1aa590f3fcc975ec11d5375efb18f6e2d53e8bc5c697610b929c5efe8b66379559c3ea795

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://208.70.248.230/ty/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  e598d09eb75436c41fd667d85213895ce5dd4903474c5bc38a797e725a75d2e3.exe
- Size
  
  155KB
- MD5
  
  ce3ff26ad43b8f74c6face5a1c49f498
- SHA1
  
  e90a6530271fc1cc61be9577b007d4c0af9bc8dd
- SHA256
  
  e598d09eb75436c41fd667d85213895ce5dd4903474c5bc38a797e725a75d2e3
- SHA512
  
  8f42be57b412bfbfc11de863770ba6c2f2a7fc7ed40c3778a74f72d1aa590f3fcc975ec11d5375efb18f6e2d53e8bc5c697610b929c5efe8b66379559c3ea795
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

lokibotspywarestealertrojan