lokibot | d40ba6722ae1f278d8c73552c4b18c50808264ead08a491002de7519e984e60d | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
860ec1c4d0dab73f25b086d0fd8918b0.exe
Size 698KB
Sample210503-aydpdpq3ys
SHA256 d40ba6722ae1f278d8c73552c4b18c50808264ead08a491002de7519e984e60d
MD5 860ec1c4d0dab73f25b086d0fd8918b0
SHA1 b3e3fd2c753d0d79f3785e822bbb1c7a0d899f2d
SHA512 3678404d634453084cf41ba7a045ccc56b8685a6f1d91ab9cdfa2912bcf2d809936cfe0fe49f7d3161426557bc0a8fd4074adfad6cf3eda5a23cdf5d76b5d10b
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://amrp.tw/kayo/gate.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  860ec1c4d0dab73f25b086d0fd8918b0.exe
- Size 698KB
- SHA256 d40ba6722ae1f278d8c73552c4b18c50808264ead08a491002de7519e984e60d
- MD5 860ec1c4d0dab73f25b086d0fd8918b0
- SHA1 b3e3fd2c753d0d79f3785e822bbb1c7a0d899f2d
- SHA512 3678404d634453084cf41ba7a045ccc56b8685a6f1d91ab9cdfa2912bcf2d809936cfe0fe49f7d3161426557bc0a8fd4074adfad6cf3eda5a23cdf5d76b5d10b
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan