lokibot | 58d86e59c0c528d232dff4286a1140a433b5e90c90bfcdc076d63675311940d2 | Triage

Sharing

General

Target

58d86e59c0c528d232dff4286a1140a433b5e90c90bfcdc076d63675311940d2.exe
Size

440KB
Sample

210118-5tnrq3k8sn
MD5

eb7b24f994ac3cfaffd1590b028e34dc
SHA1

89742cc47ad7c726bea52380755473e6185e7891
SHA256

58d86e59c0c528d232dff4286a1140a433b5e90c90bfcdc076d63675311940d2
SHA512

3db8ff81563921e5cd7d680bde50bd1dc52ab7550f943d5670d133444d6e39944a70c2ee3fb762dfda04ffd9c22158d004e6e9c13538c767802441d04f76cac8

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://23.238.43.43/taker/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  58d86e59c0c528d232dff4286a1140a433b5e90c90bfcdc076d63675311940d2.exe
- Size
  
  440KB
- MD5
  
  eb7b24f994ac3cfaffd1590b028e34dc
- SHA1
  
  89742cc47ad7c726bea52380755473e6185e7891
- SHA256
  
  58d86e59c0c528d232dff4286a1140a433b5e90c90bfcdc076d63675311940d2
- SHA512
  
  3db8ff81563921e5cd7d680bde50bd1dc52ab7550f943d5670d133444d6e39944a70c2ee3fb762dfda04ffd9c22158d004e6e9c13538c767802441d04f76cac8
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan