lokibot | af08e26306aac69b46c773577ef14cd6d1fa8424f4a1241bc47a954ac2ecd8bb | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Cotización.pdf.exe
Size 482KB
Sample210602-8llrtfk52a
SHA256 af08e26306aac69b46c773577ef14cd6d1fa8424f4a1241bc47a954ac2ecd8bb
MD5 a4c8df82cfde08c8b09389064eba0d20
SHA1 3a58f9a2863e097cd2ee1ab127063cec84530c54
SHA512 6c86b8f0407dcd7b12f06cf1f8e11fe456b636f27469728fb891f64a8e852e4976755ca8b927222ce48f27d7f5f0345b96fcf31c00b49270709788e7245c2a8b
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://173.208.204.37/k.php/qQzri6xMLsi34
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  Cotización.pdf.exe
- Size 482KB
- SHA256 af08e26306aac69b46c773577ef14cd6d1fa8424f4a1241bc47a954ac2ecd8bb
- MD5 a4c8df82cfde08c8b09389064eba0d20
- SHA1 3a58f9a2863e097cd2ee1ab127063cec84530c54
- SHA512 6c86b8f0407dcd7b12f06cf1f8e11fe456b636f27469728fb891f64a8e852e4976755ca8b927222ce48f27d7f5f0345b96fcf31c00b49270709788e7245c2a8b
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan