lokibot | eef20ad084cce596d60be110ffa96a7cc93b5a38cbc2bbe773ca66ae771e4889 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Informe bancario.xlsx.bat.exe
Size 710KB
Sample210708-yes1b2aj5x
SHA256 eef20ad084cce596d60be110ffa96a7cc93b5a38cbc2bbe773ca66ae771e4889
MD5 00862d9d48cc080f755ffb8080ed34ca
SHA1 c0a7c9945df3a55c01d5441f3181533030542013
SHA512 a7e561a95cae67031ce62665703a5a3784f030df199546e76344587db1e36fa4ffd303d861d7667d81e16d34e2c3e37e5271da4751a2c6d2ae8f9192ed3934d7
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://185.227.139.18/dsaicosaicasdi.php/FXsbYX1K4uTzS
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  Informe bancario.xlsx.bat.exe
- Size 710KB
- SHA256 eef20ad084cce596d60be110ffa96a7cc93b5a38cbc2bbe773ca66ae771e4889
- MD5 00862d9d48cc080f755ffb8080ed34ca
- SHA1 c0a7c9945df3a55c01d5441f3181533030542013
- SHA512 a7e561a95cae67031ce62665703a5a3784f030df199546e76344587db1e36fa4ffd303d861d7667d81e16d34e2c3e37e5271da4751a2c6d2ae8f9192ed3934d7
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan