lokibot | 6329c43eca50953976efaccaa18465ed3f7e77bb2b8e7f52b16a3fc0a23cadcd | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
d3ePixq21DuQoYE.exe
Size 812KB
Sample210128-v6ep9ln5ea
SHA256 6329c43eca50953976efaccaa18465ed3f7e77bb2b8e7f52b16a3fc0a23cadcd
MD5 d1b2dbcfd93f09e2d62fb5cff61da4bf
SHA1 f926668cdc495d7c969dd90518e17f236440feae
SHA512 2e7b16934a3e97a312dbb0740a14de1f23b300d04f8e2dcbb4ae872d7644c48aa0be29d917dc9e6700a3ffc593c0209786e317c731626bf997ba7c3479d072f3
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://becharnise.ir/twp/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  d3ePixq21DuQoYE.exe
- Size 812KB
- SHA256 6329c43eca50953976efaccaa18465ed3f7e77bb2b8e7f52b16a3fc0a23cadcd
- MD5 d1b2dbcfd93f09e2d62fb5cff61da4bf
- SHA1 f926668cdc495d7c969dd90518e17f236440feae
- SHA512 2e7b16934a3e97a312dbb0740a14de1f23b300d04f8e2dcbb4ae872d7644c48aa0be29d917dc9e6700a3ffc593c0209786e317c731626bf997ba7c3479d072f3
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan