lokibot | 9a199e2b4e80ae388fb016bd30162720cd9da81274ac9eac15d4dcffd9be28dc | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
wininit.exe
Size 808KB
Sample210712-nzafcksake
SHA256 9a199e2b4e80ae388fb016bd30162720cd9da81274ac9eac15d4dcffd9be28dc
MD5 a954aade1438f60c08c42beb485199a9
SHA1 d199ed30829b7351774317bf2716cb592caccf12
SHA512 e9ac4e4f95441dad42b97024db4de55aca2200b2803c218ddd6b82400d647a2a36a00477659e29eb0b7f304b65a288d1bba6d5c31d6a9a5999c3506b05c65673
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://185.227.139.18/dsaicosaicasdi.php/S4wFP8QBww9Tp
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  wininit.exe
- Size 808KB
- SHA256 9a199e2b4e80ae388fb016bd30162720cd9da81274ac9eac15d4dcffd9be28dc
- MD5 a954aade1438f60c08c42beb485199a9
- SHA1 d199ed30829b7351774317bf2716cb592caccf12
- SHA512 e9ac4e4f95441dad42b97024db4de55aca2200b2803c218ddd6b82400d647a2a36a00477659e29eb0b7f304b65a288d1bba6d5c31d6a9a5999c3506b05c65673
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan