lokibot | d8073b80ab8800400dd1a78ebe8cf04e87ca119e0aff49307956fe3cf13bd772 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Shipping Documents.img .exe
Size 679KB
Sample210624-flmn1v2q42
SHA256 d8073b80ab8800400dd1a78ebe8cf04e87ca119e0aff49307956fe3cf13bd772
MD5 7d9fce60f332861fcd2260803f10e0eb
SHA1 5c011889f04c46a7e49c740c959efd1d722d65d6
SHA512 e2bda565f202badf3a82be01101d63066fa736e40703dfd8df593c18279963dd8e4075654c5e904867bf74a908a5accf4ad3e2d3b5edb509aa88343905952d14
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://63.141.228.141/32.php/5mGrB9x77E21g
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  Shipping Documents.img .exe
- Size 679KB
- SHA256 d8073b80ab8800400dd1a78ebe8cf04e87ca119e0aff49307956fe3cf13bd772
- MD5 7d9fce60f332861fcd2260803f10e0eb
- SHA1 5c011889f04c46a7e49c740c959efd1d722d65d6
- SHA512 e2bda565f202badf3a82be01101d63066fa736e40703dfd8df593c18279963dd8e4075654c5e904867bf74a908a5accf4ad3e2d3b5edb509aa88343905952d14
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan