lokibot | eb02dec52db3fd021ee253bda1c33d50f4b9c4fa61565665504f4a68a6d076bc | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
d8efcc460403997c2b5bc549e1e68a4c.exe
Size 515KB
Sample210401-6yd27ayvva
SHA256 eb02dec52db3fd021ee253bda1c33d50f4b9c4fa61565665504f4a68a6d076bc
MD5 d8efcc460403997c2b5bc549e1e68a4c
SHA1 bba051a418568988415ccf5fcc51a138b48526ae
SHA512 9c44c36b8ffac309175e8700312eaa84140038525f13f4485685092a3231d43088f0d7d441b2e45d38095cab22afd28dd49ee7bfe7b7bbd0ecbb85389773c629
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://prosperman.us/coco/coco3/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  d8efcc460403997c2b5bc549e1e68a4c.exe
- Size 515KB
- SHA256 eb02dec52db3fd021ee253bda1c33d50f4b9c4fa61565665504f4a68a6d076bc
- MD5 d8efcc460403997c2b5bc549e1e68a4c
- SHA1 bba051a418568988415ccf5fcc51a138b48526ae
- SHA512 9c44c36b8ffac309175e8700312eaa84140038525f13f4485685092a3231d43088f0d7d441b2e45d38095cab22afd28dd49ee7bfe7b7bbd0ecbb85389773c629
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan