lokibot | 50bf04730d6eff098559c9ed03d0eab638bcb9bd954dc5b41ed37413bf47b3a1 | Triage

Sharing

General

Target

50bf04730d6eff098559c9ed03d0eab638bcb9bd954dc5b41ed37413bf47b3a1.exe
Size

987KB
Sample

210115-sbj12ydwk6
MD5

142d300f5549ce63cef48ed7e6feb56c
SHA1

c05ce8f46220e9c5fbc6cd179de04b64df5014dd
SHA256

50bf04730d6eff098559c9ed03d0eab638bcb9bd954dc5b41ed37413bf47b3a1
SHA512

4125b0b01388094ff5fd4b8c9168f811d63d04f885e3508ebb91c8bb9eed49a00ecaec066b5783a0ae206eea9e89b9e26b4cc37f3f84fa7bddc5e5fd9f5a653a

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://51.195.53.221/p.php/qElaNgWyezEFV

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  50bf04730d6eff098559c9ed03d0eab638bcb9bd954dc5b41ed37413bf47b3a1.exe
- Size
  
  987KB
- MD5
  
  142d300f5549ce63cef48ed7e6feb56c
- SHA1
  
  c05ce8f46220e9c5fbc6cd179de04b64df5014dd
- SHA256
  
  50bf04730d6eff098559c9ed03d0eab638bcb9bd954dc5b41ed37413bf47b3a1
- SHA512
  
  4125b0b01388094ff5fd4b8c9168f811d63d04f885e3508ebb91c8bb9eed49a00ecaec066b5783a0ae206eea9e89b9e26b4cc37f3f84fa7bddc5e5fd9f5a653a
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan