lokibot | 813643e0360e8502bbb023e01048d91c300fa8fdae2b5c3023d56fd3c4eaf409 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
transferencia.PDF____________________________.bat
Size 34.0MB
Sample210714-acfyxc193e
SHA256 813643e0360e8502bbb023e01048d91c300fa8fdae2b5c3023d56fd3c4eaf409
MD5 65fa55d2469c14ac829514bb5919a88c
SHA1 b711e211de5c6707228b484261673a742d212f20
SHA512 a46b0a444e1a2978517ce4e15b6f86c87b9f60f0c1f0b6fd7f5b43556c8e4be59aa533729bffadce25c0ab536511dcc4993c43e3440eae5a9deb23071b49119e
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://185.227.139.18/dsaicosaicasdi.php/a1NQk98eWCWX2
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  transferencia.PDF____________________________.bat
- Size 34.0MB
- SHA256 813643e0360e8502bbb023e01048d91c300fa8fdae2b5c3023d56fd3c4eaf409
- MD5 65fa55d2469c14ac829514bb5919a88c
- SHA1 b711e211de5c6707228b484261673a742d212f20
- SHA512 a46b0a444e1a2978517ce4e15b6f86c87b9f60f0c1f0b6fd7f5b43556c8e4be59aa533729bffadce25c0ab536511dcc4993c43e3440eae5a9deb23071b49119e
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan