lokibot | cb0bb54b2ec784a7cd33736eabd462fae2fb9ab7c1f89a4a91300a0816f6db17 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
5b4431829c1d279e1f77cf9d3a4a05c9.exe
Size 972KB
Sample210205-gy2hckedd2
SHA256 cb0bb54b2ec784a7cd33736eabd462fae2fb9ab7c1f89a4a91300a0816f6db17
MD5 5b4431829c1d279e1f77cf9d3a4a05c9
SHA1 77e710349d44fbe8bde19439c63a81bbbefb1b00
SHA512 65163a0ddea42e28fee512fd83b3afe5fac63a3c0179a670fdd8c9eddf5ee5a15cb9c5ed00e1868493efde590ffed78a6edd7d4dee889c9cf5b6048c4b1f5b6a
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://becharnise.ir/tws/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  5b4431829c1d279e1f77cf9d3a4a05c9.exe
- Size 972KB
- SHA256 cb0bb54b2ec784a7cd33736eabd462fae2fb9ab7c1f89a4a91300a0816f6db17
- MD5 5b4431829c1d279e1f77cf9d3a4a05c9
- SHA1 77e710349d44fbe8bde19439c63a81bbbefb1b00
- SHA512 65163a0ddea42e28fee512fd83b3afe5fac63a3c0179a670fdd8c9eddf5ee5a15cb9c5ed00e1868493efde590ffed78a6edd7d4dee889c9cf5b6048c4b1f5b6a
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan