lokibot | e972405e876cec1144ec48c09a4e8ffe7f1b01d81e08df7189a4a63069e41494 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
5c94c9b142cbf67442ee7bca8f7a9297.exe
Size 444KB
Sample210331-rw1x6hdjs2
SHA256 e972405e876cec1144ec48c09a4e8ffe7f1b01d81e08df7189a4a63069e41494
MD5 5c94c9b142cbf67442ee7bca8f7a9297
SHA1 8e91587bde86439832af2802c8c2f060d58e1aea
SHA512 0a681ee8114bfb0c94f95b452c1628efac6e8262fbc4967512ab06b3c1a844f215dcbcc625adc9ffe49111835fb0dc9f2d74e84ad6271b8f6167856bcae67831
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://msslrsa-motherson.com/coco/coco4/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  5c94c9b142cbf67442ee7bca8f7a9297.exe
- Size 444KB
- SHA256 e972405e876cec1144ec48c09a4e8ffe7f1b01d81e08df7189a4a63069e41494
- MD5 5c94c9b142cbf67442ee7bca8f7a9297
- SHA1 8e91587bde86439832af2802c8c2f060d58e1aea
- SHA512 0a681ee8114bfb0c94f95b452c1628efac6e8262fbc4967512ab06b3c1a844f215dcbcc625adc9ffe49111835fb0dc9f2d74e84ad6271b8f6167856bcae67831
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan