lokibot | f98a75fd01c7f14fced46ece4df5e4eea63780a73c8804d0d9eaebf466b9debe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
proforma ivoice.exe
Size 733KB
Sample210618-vbevsgpa4a
SHA256 f98a75fd01c7f14fced46ece4df5e4eea63780a73c8804d0d9eaebf466b9debe
MD5 c9f5052319c31577f4b26fbcaf3e409b
SHA1 4239bdded62a85d1f916369c381e49eec89e8331
SHA512 1012c096f01fe1343ee6b8b5404af35cf0b3f1bbef0282a736c6cabdf6a56db3cc5b24499b1ce6355b7c6baa93716390e817f8163fc72e5e9d84debc429dcc78
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://manvim.co/bo/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  proforma ivoice.exe
- Size 733KB
- SHA256 f98a75fd01c7f14fced46ece4df5e4eea63780a73c8804d0d9eaebf466b9debe
- MD5 c9f5052319c31577f4b26fbcaf3e409b
- SHA1 4239bdded62a85d1f916369c381e49eec89e8331
- SHA512 1012c096f01fe1343ee6b8b5404af35cf0b3f1bbef0282a736c6cabdf6a56db3cc5b24499b1ce6355b7c6baa93716390e817f8163fc72e5e9d84debc429dcc78
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan