lokibot | 8dc3d4e2fe3d376b13ae0ff882d26d69fe06a72ab549f005b8e76beef5b3b548 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PO#PDT28394209.exe
Size 750KB
Sample210129-ves6tx17ja
SHA256 8dc3d4e2fe3d376b13ae0ff882d26d69fe06a72ab549f005b8e76beef5b3b548
MD5 d6f609adcdbd0ac294cc27ee07cb0ba2
SHA1 534f04d2acfec8795610d72238a8a9322d86fb60
SHA512 2293810ebf523e9b72df335bce22bbf324429f3ef522cf53ce1c0e29acb1b32d2803325c0e987fd4ecfc996752d0a72a91c58a302c3e6b29cf5b5d73193a8c15
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://pearl-energia-hu.ml/h1/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  PO#PDT28394209.exe
- Size 750KB
- SHA256 8dc3d4e2fe3d376b13ae0ff882d26d69fe06a72ab549f005b8e76beef5b3b548
- MD5 d6f609adcdbd0ac294cc27ee07cb0ba2
- SHA1 534f04d2acfec8795610d72238a8a9322d86fb60
- SHA512 2293810ebf523e9b72df335bce22bbf324429f3ef522cf53ce1c0e29acb1b32d2803325c0e987fd4ecfc996752d0a72a91c58a302c3e6b29cf5b5d73193a8c15
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan