lokibot | a43e700d308ec72f30fd4098b7d4113b83c244d3679f4b59f26f7f309ebefdcc | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PO Refno.192226.exe
Size 599KB
Sample210617-8hr2e8nhmj
SHA256 a43e700d308ec72f30fd4098b7d4113b83c244d3679f4b59f26f7f309ebefdcc
MD5 1013f3c7b262b9dc31e412101074704b
SHA1 2c41e16f0f1745accba5ea6797bd86daceb51835
SHA512 c8b19eaaf2e7b3256bfb46adb033856c2b6abe4cff17c21a124e7e7d287551b92a70db293aec6c73d436ffbeb90c755f7e61db50e5be78074541fc0ccb15aa1b
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://63.141.228.141/32.php/GsoXa3yQ3p8IH
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  PO Refno.192226.exe
- Size 599KB
- SHA256 a43e700d308ec72f30fd4098b7d4113b83c244d3679f4b59f26f7f309ebefdcc
- MD5 1013f3c7b262b9dc31e412101074704b
- SHA1 2c41e16f0f1745accba5ea6797bd86daceb51835
- SHA512 c8b19eaaf2e7b3256bfb46adb033856c2b6abe4cff17c21a124e7e7d287551b92a70db293aec6c73d436ffbeb90c755f7e61db50e5be78074541fc0ccb15aa1b
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan