lokibot | b97de627f21e9b429b51add91c260bf329e8df489e2f7b56d7f9b3e0dbbc315d | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.Trojan.PackedNET.578.20250.21331
Size 706KB
Sample210315-hceyl6l8va
SHA256 b97de627f21e9b429b51add91c260bf329e8df489e2f7b56d7f9b3e0dbbc315d
MD5 ab875b6489b17cce39d0655923785802
SHA1 20082b7965b68df40ac8f83f2023f7fd1c4864b6
SHA512 7c3070c23336e2cc9f645f9e0743c468b0ed0e692b76db080430716ba1df7864649948d21f02b656df47f349975467ceab9970581500a865376f138f6f22e549
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://51.195.53.221/p.php/7gEWZ4upg1lkl
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  SecuriteInfo.com.Trojan.PackedNET.578.20250.21331
- Size 706KB
- SHA256 b97de627f21e9b429b51add91c260bf329e8df489e2f7b56d7f9b3e0dbbc315d
- MD5 ab875b6489b17cce39d0655923785802
- SHA1 20082b7965b68df40ac8f83f2023f7fd1c4864b6
- SHA512 7c3070c23336e2cc9f645f9e0743c468b0ed0e692b76db080430716ba1df7864649948d21f02b656df47f349975467ceab9970581500a865376f138f6f22e549
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan