Overview

overview

10

Static

static

4mjt6fCkySAbsm1.exe

windows7_x64

10

4mjt6fCkySAbsm1.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4mjt6fCkySAbsm1.exe

  • Size

    551KB

  • Sample

    210727-7ke9yk1fcx

  • MD5

    6f91a99c25ae0ba4dbfc5fe127c7ee36

  • SHA1

    1dba39475d7a4279009b87b117f683c398f8245b

  • SHA256

    f261e6699cf2c762ffc153203e99ac2fab25a21af25e4a17558562531a5c0faa

  • SHA512

    f30ba3955310d05962e4611061ac88e354d9af83a81619303346c845f8c6fff5b25add2f137f0235270be7f3f43b3df3832c893199caa57233ca35edcb4674d4

Score
10/10
lokibotspywarestealersuricatatrojan

Malware Config

Extracted

Family

lokibot

C2

http://zascocs.xyz/cd/ui/fo.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      4mjt6fCkySAbsm1.exe

    • Size

      551KB

    • MD5

      6f91a99c25ae0ba4dbfc5fe127c7ee36

    • SHA1

      1dba39475d7a4279009b87b117f683c398f8245b

    • SHA256

      f261e6699cf2c762ffc153203e99ac2fab25a21af25e4a17558562531a5c0faa

    • SHA512

      f30ba3955310d05962e4611061ac88e354d9af83a81619303346c845f8c6fff5b25add2f137f0235270be7f3f43b3df3832c893199caa57233ca35edcb4674d4

    Score
    10/10
    lokibotspywarestealersuricatatrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • suricata: ET MALWARE LokiBot Checkin

      suricata

    • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

      suricata

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks