lokibot | ffd51d05e6374da6d8db1eb2b2e43b2a61436524231edba8d1803c58ef27845a | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
f8f5b3bad883e0b62fed5af138449db6
Size 727KB
Sample210702-aecdpgyees
SHA256 ffd51d05e6374da6d8db1eb2b2e43b2a61436524231edba8d1803c58ef27845a
MD5 f8f5b3bad883e0b62fed5af138449db6
SHA1 a09c250244420c43e83433d2a54a784b1400417a
SHA512 bf325530600b0211039872b5a7b1796c5f802d7eaeaac66b5ca1b92d5b3f2db3f5776fe453cdf2f7e6434fc36b7a8bbe035566036244209cfab546ec514b36c3
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://manvim.co/fd3/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  f8f5b3bad883e0b62fed5af138449db6
- Size 727KB
- SHA256 ffd51d05e6374da6d8db1eb2b2e43b2a61436524231edba8d1803c58ef27845a
- MD5 f8f5b3bad883e0b62fed5af138449db6
- SHA1 a09c250244420c43e83433d2a54a784b1400417a
- SHA512 bf325530600b0211039872b5a7b1796c5f802d7eaeaac66b5ca1b92d5b3f2db3f5776fe453cdf2f7e6434fc36b7a8bbe035566036244209cfab546ec514b36c3
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2