lokibot | 78e8252c53ad5ef298a4245fd8e99ea360a1c35658f3a4e786d23e7cdf6ef421 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.Trojan.Win32.Save.a.16492.6754
Size 974KB
Sample210629-c6bjt7981e
SHA256 78e8252c53ad5ef298a4245fd8e99ea360a1c35658f3a4e786d23e7cdf6ef421
MD5 5c78258e75d746baf873565bda79dff2
SHA1 1dc93e3584bcb7f721c9b7e3ab379292c6b52031
SHA512 7cce1f9d0ebb31b5df96fcb1aaf4765c64194479c4c2a69c96f6977b63c892454b75aaa122cff7ac4eadc4ca8388e58b80a7c03e978df645c5541a19e68ea1ac
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://63.141.228.141/32.php/auJMYiGBL7JHG
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  SecuriteInfo.com.Trojan.Win32.Save.a.16492.6754
- Size 974KB
- SHA256 78e8252c53ad5ef298a4245fd8e99ea360a1c35658f3a4e786d23e7cdf6ef421
- MD5 5c78258e75d746baf873565bda79dff2
- SHA1 1dc93e3584bcb7f721c9b7e3ab379292c6b52031
- SHA512 7cce1f9d0ebb31b5df96fcb1aaf4765c64194479c4c2a69c96f6977b63c892454b75aaa122cff7ac4eadc4ca8388e58b80a7c03e978df645c5541a19e68ea1ac
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan