lokibot | 297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1 | Triage

Sharing

General

Target

297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe
Size

1011KB
Sample

210721-lpt5vy9792
MD5

060eada71f4d9832ebc38b5e66444dd7
SHA1

d9d7b08ae7a8ff61626a995e995cac8773c3bfc7
SHA256

297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1
SHA512

273d9a649f9a0bf67a7a9f2f015f3280d07775379ac3568493bb4ed0fc25f3bc90f40327b44fedb6c0c08f73788237806b9ce8c9e2cda849bf7c301f8118f780

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://manvim.co/com/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe
- Size
  
  1011KB
- MD5
  
  060eada71f4d9832ebc38b5e66444dd7
- SHA1
  
  d9d7b08ae7a8ff61626a995e995cac8773c3bfc7
- SHA256
  
  297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1
- SHA512
  
  273d9a649f9a0bf67a7a9f2f015f3280d07775379ac3568493bb4ed0fc25f3bc90f40327b44fedb6c0c08f73788237806b9ce8c9e2cda849bf7c301f8118f780
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan