lokibot | 2b99f5aaaa6cfc4766e8c7eaafe2cabccccd31ced962d84f0bc1cf97bc9a1e23 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
DHL.doc.exe
Size 352KB
Sample210302-xvsr94k4ba
SHA256 2b99f5aaaa6cfc4766e8c7eaafe2cabccccd31ced962d84f0bc1cf97bc9a1e23
MD5 5c29672ab72c2de1036a591bcfb64fc5
SHA1 9bb75d0ea2b35aa23233f14a435dbe47382ba421
SHA512 f7625f09374f1bb021cf64675cd235858b1f82d054a1ced51dea5b2d2967e8d0c4e9d4706866914e5f94a03d67c1f8415862feeebc55ff2fe07bfd4e051569fe
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://51.195.53.221/p.php/2dY9AG7m0LNWP
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  DHL.doc.exe
- Size 352KB
- SHA256 2b99f5aaaa6cfc4766e8c7eaafe2cabccccd31ced962d84f0bc1cf97bc9a1e23
- MD5 5c29672ab72c2de1036a591bcfb64fc5
- SHA1 9bb75d0ea2b35aa23233f14a435dbe47382ba421
- SHA512 f7625f09374f1bb021cf64675cd235858b1f82d054a1ced51dea5b2d2967e8d0c4e9d4706866914e5f94a03d67c1f8415862feeebc55ff2fe07bfd4e051569fe
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan