lokibot | d5081496a9c9df31fd90d31bcf8418145663c2c03df38c61bed64e1adb0ae86a | Triage

Sharing

General

Target

d5081496a9c9df31fd90d31bcf8418145663c2c03df38c61bed64e1adb0ae86a.exe
Size

265KB
Sample

210118-88jgs68zsa
MD5

49207578a3dc8c31fd78a2d51a7516e8
SHA1

df267eb4b78a649ef2b0f53cfde2ec0dfaa16d3e
SHA256

d5081496a9c9df31fd90d31bcf8418145663c2c03df38c61bed64e1adb0ae86a
SHA512

617bdc49b831b00efbabb532558f7ed4162afee241dc05d63af897f8938f6306756ac8cf15150d514ad7745e4f0b993540665a88ec300a1fcbe488583d003892

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://23.238.43.43/tsc/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  d5081496a9c9df31fd90d31bcf8418145663c2c03df38c61bed64e1adb0ae86a.exe
- Size
  
  265KB
- MD5
  
  49207578a3dc8c31fd78a2d51a7516e8
- SHA1
  
  df267eb4b78a649ef2b0f53cfde2ec0dfaa16d3e
- SHA256
  
  d5081496a9c9df31fd90d31bcf8418145663c2c03df38c61bed64e1adb0ae86a
- SHA512
  
  617bdc49b831b00efbabb532558f7ed4162afee241dc05d63af897f8938f6306756ac8cf15150d514ad7745e4f0b993540665a88ec300a1fcbe488583d003892
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan