lokibot | 086b930d1a631edf83cfe41204603a67e9cf4661ecee97761f7dcb8f87bb6e70 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
RFQ1220274SH0601201.exe
Size 764KB
Sample210713-eq3ydzeyfe
SHA256 086b930d1a631edf83cfe41204603a67e9cf4661ecee97761f7dcb8f87bb6e70
MD5 3b2369bdc8d2d7d0712a4e9cfb21e299
SHA1 bc90d9cadbb547952b7fd405994fb7c89cd6e211
SHA512 190f58bbefcd28e85edcf8aa273309023569f1b475ad7d071ecbc2afed576b11efcedafe0c27e2ba643a27ba05d1fb7d5ef02fb0c9aa3ae55feb640d8fabb373
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://185.227.139.18/dsaicosaicasdi.php/Ooq7cQ4IpHUWj
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  RFQ1220274SH0601201.exe
- Size 764KB
- SHA256 086b930d1a631edf83cfe41204603a67e9cf4661ecee97761f7dcb8f87bb6e70
- MD5 3b2369bdc8d2d7d0712a4e9cfb21e299
- SHA1 bc90d9cadbb547952b7fd405994fb7c89cd6e211
- SHA512 190f58bbefcd28e85edcf8aa273309023569f1b475ad7d071ecbc2afed576b11efcedafe0c27e2ba643a27ba05d1fb7d5ef02fb0c9aa3ae55feb640d8fabb373
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan