lokibot | ea3ee3d0360a7d1026af23da26cfee722a22dda0ad90ff647bffd848db7e08e6 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.Generic.mg.500412f15b437a91.12345
Size 883KB
Sample210204-p4kdwlsbv6
SHA256 ea3ee3d0360a7d1026af23da26cfee722a22dda0ad90ff647bffd848db7e08e6
MD5 500412f15b437a91f4798038cb483cf7
SHA1 3c7d00b44e14aea713dd34c8dfbd8c104b97b517
SHA512 11587c4fbc6c44d0192f7375a84ec35fa5e18d614dfa7e3460bdd467fb009c684d6a03bb3483b46378ac2d97a1cbb49b732b1e63ffcb387964b041b0ba82b0dd
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://becharnise.ir/fa11/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  SecuriteInfo.com.Generic.mg.500412f15b437a91.12345
- Size 883KB
- SHA256 ea3ee3d0360a7d1026af23da26cfee722a22dda0ad90ff647bffd848db7e08e6
- MD5 500412f15b437a91f4798038cb483cf7
- SHA1 3c7d00b44e14aea713dd34c8dfbd8c104b97b517
- SHA512 11587c4fbc6c44d0192f7375a84ec35fa5e18d614dfa7e3460bdd467fb009c684d6a03bb3483b46378ac2d97a1cbb49b732b1e63ffcb387964b041b0ba82b0dd
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan