lokibot | e24432776021ce6abef3df321e67fdfa684e2a2b2b61ee417e406b6feab92087 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Purchase Order RFQ-HL51L07.exe
Size 983KB
Sample210212-wnt79wv3mx
SHA256 e24432776021ce6abef3df321e67fdfa684e2a2b2b61ee417e406b6feab92087
MD5 b2acecde3b67c8eeab8f5ff1316cbbd0
SHA1 1b56e3c6a1af352bf09b9011bbf89795130f0ba3
SHA512 f275fabd968b7830fb7dcdb05aacf42a9ecc14076b16b33c923b28569e55cb2862ad7293b9d47a98fa7a07bfe5246acb0c0bbc119f447ab392a72aa20978ffa5
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://51.195.53.221/p.php/cfOoZYb0LXPms
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  Purchase Order RFQ-HL51L07.exe
- Size 983KB
- SHA256 e24432776021ce6abef3df321e67fdfa684e2a2b2b61ee417e406b6feab92087
- MD5 b2acecde3b67c8eeab8f5ff1316cbbd0
- SHA1 1b56e3c6a1af352bf09b9011bbf89795130f0ba3
- SHA512 f275fabd968b7830fb7dcdb05aacf42a9ecc14076b16b33c923b28569e55cb2862ad7293b9d47a98fa7a07bfe5246acb0c0bbc119f447ab392a72aa20978ffa5
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

lokibotspywarestealertrojan