lokibot | a3e84da58dbdc9813c1a8bd17a5b07e39f8d1322b8ee7d70bd5fe61b481ac492 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Bank report.pdf.exe
Size 723KB
Sample210712-k2pm8zf5ex
SHA256 a3e84da58dbdc9813c1a8bd17a5b07e39f8d1322b8ee7d70bd5fe61b481ac492
MD5 6453d45f9cf9da2e5ed1bb5f124821e4
SHA1 7ad94fa56eb04595751a8b808b8f1e3668688e00
SHA512 f1b614087b743472c7608f8503da04a5c68c7caebddbd5c3650a36b67febdd915ae2b90279a33dcbea126ad0258ded784139c23580b1059db0a7c63b53e7746b
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://185.227.139.18/dsaicosaicasdi.php/uirKQcHWX0e7x
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  Bank report.pdf.exe
- Size 723KB
- SHA256 a3e84da58dbdc9813c1a8bd17a5b07e39f8d1322b8ee7d70bd5fe61b481ac492
- MD5 6453d45f9cf9da2e5ed1bb5f124821e4
- SHA1 7ad94fa56eb04595751a8b808b8f1e3668688e00
- SHA512 f1b614087b743472c7608f8503da04a5c68c7caebddbd5c3650a36b67febdd915ae2b90279a33dcbea126ad0258ded784139c23580b1059db0a7c63b53e7746b
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan