lokibot | b8f93d593fb0feaa265c385ab4afb8c8e1bb7908b166cf68b6efb36ed1f7fa4f | Triage

Sharing

General

Target

b8f93d593fb0feaa265c385ab4afb8c8e1bb7908b166cf68b6efb36ed1f7fa4f.exe
Size

265KB
Sample

210118-p29453bp7x
MD5

290f17a9e8b6647b57eb7c8b3ee85717
SHA1

b86cc8d553f432a507ba24ed724218da09b3d6cb
SHA256

b8f93d593fb0feaa265c385ab4afb8c8e1bb7908b166cf68b6efb36ed1f7fa4f
SHA512

76224f371550b9129f7329af0ea34c182be7819af3779dbf120e8e641796fb90004813cc094369c004bfae7fb5ac02cdc000aed778ba4e7ca4c091d9621e7e43

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://blueriiver-eu.com/zoro/zoro5/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  b8f93d593fb0feaa265c385ab4afb8c8e1bb7908b166cf68b6efb36ed1f7fa4f.exe
- Size
  
  265KB
- MD5
  
  290f17a9e8b6647b57eb7c8b3ee85717
- SHA1
  
  b86cc8d553f432a507ba24ed724218da09b3d6cb
- SHA256
  
  b8f93d593fb0feaa265c385ab4afb8c8e1bb7908b166cf68b6efb36ed1f7fa4f
- SHA512
  
  76224f371550b9129f7329af0ea34c182be7819af3779dbf120e8e641796fb90004813cc094369c004bfae7fb5ac02cdc000aed778ba4e7ca4c091d9621e7e43
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan