lokibot | f58cdcc753abc5e59a1d6367b421517b89992a43b41b9bccdb277ef69de4d6b0 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
TNT Original Invoice.exe
Size 858KB
Sample210115-h16bstdpaa
SHA256 f58cdcc753abc5e59a1d6367b421517b89992a43b41b9bccdb277ef69de4d6b0
MD5 5c7188426a084631737fc8792926945e
SHA1 3f9548fca35c6439b2f9ecc621cfb98c2be6ebc2
SHA512 97e4a513fa6bdceff46c012efb1cb74906fa3ac94903107594c0a436d6b815f15d57588113ad7917d56a2ff6e5adc96fd3f2233bc53e34ee751b1b53e1cfa4e1
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://51.195.53.221/p.php/cfOoZYb0LXPms
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  TNT Original Invoice.exe
- Size 858KB
- SHA256 f58cdcc753abc5e59a1d6367b421517b89992a43b41b9bccdb277ef69de4d6b0
- MD5 5c7188426a084631737fc8792926945e
- SHA1 3f9548fca35c6439b2f9ecc621cfb98c2be6ebc2
- SHA512 97e4a513fa6bdceff46c012efb1cb74906fa3ac94903107594c0a436d6b815f15d57588113ad7917d56a2ff6e5adc96fd3f2233bc53e34ee751b1b53e1cfa4e1
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan