lokibot | fe7479e0f85f368fe788c73b89e703e9b3d1885df1b304f8d7b2fcfe14a067a0 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cef1e0b924d0a3c707a56b83fde27470.exe
Size 982KB
Sample210420-ntvdtfk3vs
SHA256 fe7479e0f85f368fe788c73b89e703e9b3d1885df1b304f8d7b2fcfe14a067a0
MD5 cef1e0b924d0a3c707a56b83fde27470
SHA1 2f4faa0a66a7cb56a2ff341b95efbc14b5a6aa41
SHA512 09875123dd1080af0cedb52385560f2f4e1f042befbdb2b4eabb267c2e92fa8877043862ceff97751e5ed05a33fd4c36b9f7b958e9b7129cbe992ecd6b714233
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://amrp.tw/engr/gate.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  cef1e0b924d0a3c707a56b83fde27470.exe
- Size 982KB
- SHA256 fe7479e0f85f368fe788c73b89e703e9b3d1885df1b304f8d7b2fcfe14a067a0
- MD5 cef1e0b924d0a3c707a56b83fde27470
- SHA1 2f4faa0a66a7cb56a2ff341b95efbc14b5a6aa41
- SHA512 09875123dd1080af0cedb52385560f2f4e1f042befbdb2b4eabb267c2e92fa8877043862ceff97751e5ed05a33fd4c36b9f7b958e9b7129cbe992ecd6b714233
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan