lokibot | 1c92e75853c17bb45af6a066b89e395f3e0d1cb07f2f0b1bc61d2e069bba29ae | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.Artemis.389
Size 1.0MB
Sample210118-67ndty2fqe
SHA256 1c92e75853c17bb45af6a066b89e395f3e0d1cb07f2f0b1bc61d2e069bba29ae
MD5 c6091ddf2745b7edcfa535d727ea7b7a
SHA1 769608c06ff9bd184be238b6c92769533eaef750
SHA512 9c49f8df4e609552f88f3af71a96ed8829f067b556b02f207165bbe1226350883d690d09af18356eba37973d4a195a98f9741479b90958b971af819351061d75
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://okpana.com/chief/boss/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  SecuriteInfo.com.Artemis.389
- Size 1.0MB
- SHA256 1c92e75853c17bb45af6a066b89e395f3e0d1cb07f2f0b1bc61d2e069bba29ae
- MD5 c6091ddf2745b7edcfa535d727ea7b7a
- SHA1 769608c06ff9bd184be238b6c92769533eaef750
- SHA512 9c49f8df4e609552f88f3af71a96ed8829f067b556b02f207165bbe1226350883d690d09af18356eba37973d4a195a98f9741479b90958b971af819351061d75
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan