lokibot | 9afbb7350fafda2e3e4e86047c929d7dc7023956ab54f073de2ba2e93d176329 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Paymentreceiptconfirmation.exe
Size 461KB
Sample210331-nt8z8ex2tn
SHA256 9afbb7350fafda2e3e4e86047c929d7dc7023956ab54f073de2ba2e93d176329
MD5 97d447683e299b7a0ca05c4262fc8bcc
SHA1 7fb3a8620b246b573fea62e587a2dfeae2709d71
SHA512 c054508d79e534f21282a543655b55aad7050255b157725d6e47b4718c7aaf808f3558646455b836a0e54e6ef90d19eb659c1c7dddd79df348b75d6a96cb41b7
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://prosperman.us/coco/coco3/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  Paymentreceiptconfirmation.exe
- Size 461KB
- SHA256 9afbb7350fafda2e3e4e86047c929d7dc7023956ab54f073de2ba2e93d176329
- MD5 97d447683e299b7a0ca05c4262fc8bcc
- SHA1 7fb3a8620b246b573fea62e587a2dfeae2709d71
- SHA512 c054508d79e534f21282a543655b55aad7050255b157725d6e47b4718c7aaf808f3558646455b836a0e54e6ef90d19eb659c1c7dddd79df348b75d6a96cb41b7
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan