lokibot | 5d1487033d1f1c1aa34a504584016276e5cf9191e7a10d4e5aefe4cf87a5f546 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Po___20202904.exe
Size 700KB
Sample210329-7vapm4bkgn
SHA256 5d1487033d1f1c1aa34a504584016276e5cf9191e7a10d4e5aefe4cf87a5f546
MD5 f10671b7042afd73e0046ed4a7d7a9c3
SHA1 1dc41681022e3aa3320abf5ea0e214e2c83a0692
SHA512 e3814b9e5c5f48d5e7f5e3398ec49da094843b8c057f4a149ccbf730203157bfc79ed2d2aeb459907ab5b005cc216f64209aefa66f043e1fc245d50e1de15743
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://51.195.53.221/p.php/FgbebrOHmwbrQ
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  Po___20202904.exe
- Size 700KB
- SHA256 5d1487033d1f1c1aa34a504584016276e5cf9191e7a10d4e5aefe4cf87a5f546
- MD5 f10671b7042afd73e0046ed4a7d7a9c3
- SHA1 1dc41681022e3aa3320abf5ea0e214e2c83a0692
- SHA512 e3814b9e5c5f48d5e7f5e3398ec49da094843b8c057f4a149ccbf730203157bfc79ed2d2aeb459907ab5b005cc216f64209aefa66f043e1fc245d50e1de15743
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan