Overview

overview

10

Static

static

9f58c3a016...4c.exe

windows7_x64

1

9f58c3a016...4c.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9f58c3a016972b23245035213c2d914c.exe

  • Size

    1.0MB

  • Sample

    210727-8qkef2dcdx

  • MD5

    9f58c3a016972b23245035213c2d914c

  • SHA1

    35bc5fc2b0a11ac1f96240b0016d01951c979500

  • SHA256

    ef9f101dde3bdcfdb7e80989c152290d02a58a9853804fb7b691343b1d18cd5b

  • SHA512

    4af330abc090b3ff0969950084f48d1b83f3182220763a79f28d514e63b6feabf533928dc782ec02c2a5aa1f6be1363aa231276197babc1a9f4b409c330da251

Score
10/10
lokibotspywarestealersuricatatrojan

Malware Config

Extracted

Family

lokibot

C2

http://manvim.co/fd3/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      9f58c3a016972b23245035213c2d914c.exe

    • Size

      1.0MB

    • MD5

      9f58c3a016972b23245035213c2d914c

    • SHA1

      35bc5fc2b0a11ac1f96240b0016d01951c979500

    • SHA256

      ef9f101dde3bdcfdb7e80989c152290d02a58a9853804fb7b691343b1d18cd5b

    • SHA512

      4af330abc090b3ff0969950084f48d1b83f3182220763a79f28d514e63b6feabf533928dc782ec02c2a5aa1f6be1363aa231276197babc1a9f4b409c330da251

    Score
    10/10
    lokibotspywarestealersuricatatrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • suricata: ET MALWARE LokiBot Checkin

      suricata

    • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

      suricata

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks