lokibot | c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190

General

Target

Detalles del banco.pdf.exe
Size

538KB
MD5

3965feca216cde849f987b614794b46c
SHA1

d5fd435edf3348930b1500d9b10b3b010b07ef99
SHA256

c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190
SHA512

684381a00700a14c9c0bb9b4cb337f00057ccd678c825b3ab3b578ee6a98dd7c8a46fb42734be7a51dbb47ef21d03929428ab17ef2be327259d8c99439757c5b

Score

10^/10

Family

lokibot

C2

https://zamloki.xyz/des/co/tox.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata
Suspicious use of SetThreadContext 1 IoCs

Processes:

Detalles del banco.pdf.exe

description pid process target process

PID 2388 set thread context of 3752 2388 Detalles del banco.pdf.exe Detalles del banco.pdf.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

Detalles del banco.pdf.exe

pid process

3752 Detalles del banco.pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Detalles del banco.pdf.exe

description pid process

Token: SeDebugPrivilege 3752 Detalles del banco.pdf.exe

description	pid	process	target process
PID 2388 set thread context of 3752	2388	Detalles del banco.pdf.exe	Detalles del banco.pdf.exe

pid	process
3752	Detalles del banco.pdf.exe

description	pid	process
Token: SeDebugPrivilege	3752	Detalles del banco.pdf.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Detalles del banco.pdf.exe

description	pid	process	target process
PID 2388 wrote to memory of 3752	2388	Detalles del banco.pdf.exe	Detalles del banco.pdf.exe
PID 2388 wrote to memory of 3752	2388	Detalles del banco.pdf.exe	Detalles del banco.pdf.exe
PID 2388 wrote to memory of 3752	2388	Detalles del banco.pdf.exe	Detalles del banco.pdf.exe
PID 2388 wrote to memory of 3752	2388	Detalles del banco.pdf.exe	Detalles del banco.pdf.exe
PID 2388 wrote to memory of 3752	2388	Detalles del banco.pdf.exe	Detalles del banco.pdf.exe
PID 2388 wrote to memory of 3752	2388	Detalles del banco.pdf.exe	Detalles del banco.pdf.exe
PID 2388 wrote to memory of 3752	2388	Detalles del banco.pdf.exe	Detalles del banco.pdf.exe
PID 2388 wrote to memory of 3752	2388	Detalles del banco.pdf.exe	Detalles del banco.pdf.exe
PID 2388 wrote to memory of 3752	2388	Detalles del banco.pdf.exe	Detalles del banco.pdf.exe

memory/2388-114-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2388-116-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/2388-117-0x0000000004C60000-0x0000000004C61000-memory.dmp

Filesize
4KB

Download
memory/2388-118-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Filesize
4KB

Download
memory/2388-119-0x0000000004BC0000-0x00000000050BE000-memory.dmp

Filesize
5.0MB

Download
memory/2388-120-0x0000000004E50000-0x0000000004E52000-memory.dmp

Filesize
8KB

Download
memory/2388-121-0x00000000067A0000-0x00000000067A1000-memory.dmp

Filesize
4KB

Download
memory/2388-122-0x0000000008450000-0x00000000084BC000-memory.dmp

Filesize
432KB

Download
memory/2388-123-0x00000000083E0000-0x0000000008401000-memory.dmp

Filesize
132KB

Download
memory/3752-124-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3752-125-0x00000000004139DE-mapping.dmp

Download
memory/3752-126-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download