lokibot | 18a2d764976f493babcba30bfbf8fb1260c39f6f05ff0a217932b0e4a5755c59 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
IProgress.exe
Size 13.6MB
Sample210224-chlabg9e5s
SHA256 18a2d764976f493babcba30bfbf8fb1260c39f6f05ff0a217932b0e4a5755c59
MD5 496552c52b793f7b6b15709f6837d65a
SHA1 891db38c7826a7445cce456eb273fddc9219bf58
SHA512 e6d951a20e965dce8e1b55a503618fe6a79bb2289b78a47dca4cb40f9f466f5b4d5de71f6e5afaa4e6019e9254de5ceccfa47db475770ed5e907395e8d64d515
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://51.195.53.221/p.php/UjL7jh4u2t3CH
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  IProgress.exe
- Size 13.6MB
- SHA256 18a2d764976f493babcba30bfbf8fb1260c39f6f05ff0a217932b0e4a5755c59
- MD5 496552c52b793f7b6b15709f6837d65a
- SHA1 891db38c7826a7445cce456eb273fddc9219bf58
- SHA512 e6d951a20e965dce8e1b55a503618fe6a79bb2289b78a47dca4cb40f9f466f5b4d5de71f6e5afaa4e6019e9254de5ceccfa47db475770ed5e907395e8d64d515
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan