lokibot | ec7ed5439c52dd30d70a2bbf16a6b217f3a8720c2ee6f0847d7483ff55a50a84 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
411d1d65795efcf9b4a5e68b7122d7bc.exe
Size 959KB
Sample210324-vsfe68ymb2
SHA256 ec7ed5439c52dd30d70a2bbf16a6b217f3a8720c2ee6f0847d7483ff55a50a84
MD5 411d1d65795efcf9b4a5e68b7122d7bc
SHA1 124c0130dbb1dccdf33c987e7bd96c7ca02ed8df
SHA512 2fc2fb4885aaac5582cdc18da9e830fa38e555451f3bab851100316f31dede0faf996c494ce5db3dd14df1bf41447c83f5c097928343242e39ce957a9964ddb9
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://interplasts-uae.com/coco/coco4/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  411d1d65795efcf9b4a5e68b7122d7bc.exe
- Size 959KB
- SHA256 ec7ed5439c52dd30d70a2bbf16a6b217f3a8720c2ee6f0847d7483ff55a50a84
- MD5 411d1d65795efcf9b4a5e68b7122d7bc
- SHA1 124c0130dbb1dccdf33c987e7bd96c7ca02ed8df
- SHA512 2fc2fb4885aaac5582cdc18da9e830fa38e555451f3bab851100316f31dede0faf996c494ce5db3dd14df1bf41447c83f5c097928343242e39ce957a9964ddb9
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan