lokibot | c17b37bb3f9b18f160029a7d48d3beef1a15cb3fd51033e6c6ccf4c871377c12 | Triage

Sharing

General

Target

c17b37bb3f9b18f160029a7d48d3beef1a15cb3fd51033e6c6ccf4c871377c12.exe
Size

1.1MB
Sample

210721-ncp923q59e
MD5

825ebfccb4c9e1b2a71f8e931d751aaf
SHA1

9318735795acaca9794a92030492b9c2c5fc0aab
SHA256

c17b37bb3f9b18f160029a7d48d3beef1a15cb3fd51033e6c6ccf4c871377c12
SHA512

6609b39beec7a86d7994a8b3198556ede8a9654ce84d517ccdc58d5d650361a1e369faba05ca5c93ed998355c60d2c17a9031547f5df9a865e42ab644f7f2bf0

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

https://luoslasco.xyz/to/ya/vd.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  c17b37bb3f9b18f160029a7d48d3beef1a15cb3fd51033e6c6ccf4c871377c12.exe
- Size
  
  1.1MB
- MD5
  
  825ebfccb4c9e1b2a71f8e931d751aaf
- SHA1
  
  9318735795acaca9794a92030492b9c2c5fc0aab
- SHA256
  
  c17b37bb3f9b18f160029a7d48d3beef1a15cb3fd51033e6c6ccf4c871377c12
- SHA512
  
  6609b39beec7a86d7994a8b3198556ede8a9654ce84d517ccdc58d5d650361a1e369faba05ca5c93ed998355c60d2c17a9031547f5df9a865e42ab644f7f2bf0
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan