lokibot | 59ff117201f8193fa896c1078e3dcd771cf08de2e247f8bafe0a618ea3da2a8e | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
1eeed95ee82d56ecd8b6e5502ab5fc68.exe
Size 1.1MB
Sample210305-cy6bx3js2j
SHA256 59ff117201f8193fa896c1078e3dcd771cf08de2e247f8bafe0a618ea3da2a8e
MD5 1eeed95ee82d56ecd8b6e5502ab5fc68
SHA1 41550c02726af2fa5cdc4ecf3eab464d5b4a5a1a
SHA512 cf5851f0de929a5384668ca0e43b9702381134131950858306cb44938fd4645e0ed471fd179910d319d6013abdefd512acf315a8401f94c7f94032a10cb29883
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://turbinetechnlcs.com/coco/coco1/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  1eeed95ee82d56ecd8b6e5502ab5fc68.exe
- Size 1.1MB
- SHA256 59ff117201f8193fa896c1078e3dcd771cf08de2e247f8bafe0a618ea3da2a8e
- MD5 1eeed95ee82d56ecd8b6e5502ab5fc68
- SHA1 41550c02726af2fa5cdc4ecf3eab464d5b4a5a1a
- SHA512 cf5851f0de929a5384668ca0e43b9702381134131950858306cb44938fd4645e0ed471fd179910d319d6013abdefd512acf315a8401f94c7f94032a10cb29883
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan