lokibot | b0c0008665331e457b183e736be59cbac52b32b04093bc3fc0df91c0837a6448 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ProformaInvoice271pdf.exe
Size 889KB
Sample210622-1cxt7azaba
SHA256 b0c0008665331e457b183e736be59cbac52b32b04093bc3fc0df91c0837a6448
MD5 b52b457eda0180e2fbf73383b00ced88
SHA1 b6fcc4c5797ba4babe7d23e7c210c45d572684cf
SHA512 3219144b18d59032d44a472202619214b178ea478053f6e0def063d90946993c23e6d6f7d923fc27b9936ed25d5b52751ce0d71749e208eb6648aaf98335ce1f
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://butibuti.ml/debs/fletch/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  ProformaInvoice271pdf.exe
- Size 889KB
- SHA256 b0c0008665331e457b183e736be59cbac52b32b04093bc3fc0df91c0837a6448
- MD5 b52b457eda0180e2fbf73383b00ced88
- SHA1 b6fcc4c5797ba4babe7d23e7c210c45d572684cf
- SHA512 3219144b18d59032d44a472202619214b178ea478053f6e0def063d90946993c23e6d6f7d923fc27b9936ed25d5b52751ce0d71749e208eb6648aaf98335ce1f
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan