lokibot | 8f1517666a1f5f7f6d0f38814909251d41de92126c2a7df0626de2fa1ae9ba1f | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
FCED24D15DD97FB7DBD2FC3A16484709.exe
Size 968KB
Sample210408-m54rmwt1mj
SHA256 8f1517666a1f5f7f6d0f38814909251d41de92126c2a7df0626de2fa1ae9ba1f
MD5 fced24d15dd97fb7dbd2fc3a16484709
SHA1 fa4b4d7a4c431c6ba9416e1186217c7756609d42
SHA512 4fad8a8bb29925bb20d4dc1dd1a2e31ad6a36e3dfe75d704139b4b5d06e23a1e3183f4ece793da171e4cd5b63ba48a0f24f1b0924f18a1c6e817fbc1c228fd40
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://magalhaeseirmaos.pt/js/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  FCED24D15DD97FB7DBD2FC3A16484709.exe
- Size 968KB
- SHA256 8f1517666a1f5f7f6d0f38814909251d41de92126c2a7df0626de2fa1ae9ba1f
- MD5 fced24d15dd97fb7dbd2fc3a16484709
- SHA1 fa4b4d7a4c431c6ba9416e1186217c7756609d42
- SHA512 4fad8a8bb29925bb20d4dc1dd1a2e31ad6a36e3dfe75d704139b4b5d06e23a1e3183f4ece793da171e4cd5b63ba48a0f24f1b0924f18a1c6e817fbc1c228fd40
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan