lokibot | 40c6722729a64ec203376f1376ad52dec8efcf0d5a47abd8019009d799f2f97c | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
2016efd23d991477b03728e2013d9a8d.exe
Size 875KB
Sample210323-yf73n2dad6
SHA256 40c6722729a64ec203376f1376ad52dec8efcf0d5a47abd8019009d799f2f97c
MD5 2016efd23d991477b03728e2013d9a8d
SHA1 fcc10b79999705a0fabbfd2beafc756b2e6295b6
SHA512 c3cbb826977d86813166e4d65d5c4328ad89e842bf5611d10b98f242d2ebb7c2a6d3c9e2cd5bbc6edd2541d65d409937dfcb508e33491f5134bb32d20b923470
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://transcorpoil.us/ken/kaka/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  2016efd23d991477b03728e2013d9a8d.exe
- Size 875KB
- SHA256 40c6722729a64ec203376f1376ad52dec8efcf0d5a47abd8019009d799f2f97c
- MD5 2016efd23d991477b03728e2013d9a8d
- SHA1 fcc10b79999705a0fabbfd2beafc756b2e6295b6
- SHA512 c3cbb826977d86813166e4d65d5c4328ad89e842bf5611d10b98f242d2ebb7c2a6d3c9e2cd5bbc6edd2541d65d409937dfcb508e33491f5134bb32d20b923470
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan