lokibot | cec0d7386b998dba9bfa44dd0d13a423924e4cfe601d3cf8c8beb609fdb05342 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
d931e8e3243b8a32c2b4b141231cdb02.exe
Size 919KB
Sample210204-cdkszklp5e
SHA256 cec0d7386b998dba9bfa44dd0d13a423924e4cfe601d3cf8c8beb609fdb05342
MD5 d931e8e3243b8a32c2b4b141231cdb02
SHA1 1b57d5d66526a4bd9b854b014659606ad10cbed8
SHA512 f5387617971e5cbff8f1c17371d206017ed0359f83a7756c12ed8cf1870ada429a8cff5a8fc21d01e00d82b0cf3ad2a6aee7e457be3fd7ca3d28f1f96d080838
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://dickson--constant.com/chief/har/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  d931e8e3243b8a32c2b4b141231cdb02.exe
- Size 919KB
- SHA256 cec0d7386b998dba9bfa44dd0d13a423924e4cfe601d3cf8c8beb609fdb05342
- MD5 d931e8e3243b8a32c2b4b141231cdb02
- SHA1 1b57d5d66526a4bd9b854b014659606ad10cbed8
- SHA512 f5387617971e5cbff8f1c17371d206017ed0359f83a7756c12ed8cf1870ada429a8cff5a8fc21d01e00d82b0cf3ad2a6aee7e457be3fd7ca3d28f1f96d080838
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan