lokibot | ddba7f7f2dfc3893af0230bfffacaffb3bb01a118bdc9a2a7bcdbdd53f1a4f4c | Triage

Sharing

General

Target

ddba7f7f2dfc3893af0230bfffacaffb3bb01a118bdc9a2a7bcdbdd53f1a4f4c.exe
Size

1.4MB
Sample

210118-z2hcvb8r3x
MD5

6e4ac22170c939c2a9df7562cce08c24
SHA1

b22fdae7fc8753e4af513a5b940b6b7862c6ec98
SHA256

ddba7f7f2dfc3893af0230bfffacaffb3bb01a118bdc9a2a7bcdbdd53f1a4f4c
SHA512

85cc50f51c87ff479d0a174842071f2e547e41a489b4fda197935a24c56ff8c5525d75dd284dd6e50b4c68ce6290baf4a5675e1f39c7a89058bf21f4523e17cd

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://becharnise.ir/fa2/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  ddba7f7f2dfc3893af0230bfffacaffb3bb01a118bdc9a2a7bcdbdd53f1a4f4c.exe
- Size
  
  1.4MB
- MD5
  
  6e4ac22170c939c2a9df7562cce08c24
- SHA1
  
  b22fdae7fc8753e4af513a5b940b6b7862c6ec98
- SHA256
  
  ddba7f7f2dfc3893af0230bfffacaffb3bb01a118bdc9a2a7bcdbdd53f1a4f4c
- SHA512
  
  85cc50f51c87ff479d0a174842071f2e547e41a489b4fda197935a24c56ff8c5525d75dd284dd6e50b4c68ce6290baf4a5675e1f39c7a89058bf21f4523e17cd
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan