lokibot | 5ed35d6d4d4045dddaba338ea5d2858a699e1cafa80077151ad6d2923121af8e

General

Target

Factura comercial.exe
Size

556KB
MD5

0d4b6d93b2c7624ac7ba28315445380a
SHA1

df99bf7d6297a448aa27e4c6e5676d0a1b43a5c4
SHA256

5ed35d6d4d4045dddaba338ea5d2858a699e1cafa80077151ad6d2923121af8e
SHA512

a29d3b067e136cafd9d5513f1ffebf74e2152ed78c6c6cde7a544a895fcfe5d2447a29809e9a2f8bf5388b5dcaed59ac9a124c5f1c19e2d9b994c05586d5dfd9

Score

10^/10

Family

lokibot

C2

https://pakilogs2020.xyz/t/e/ff.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata
Suspicious use of SetThreadContext 1 IoCs

Processes:

Factura comercial.exe

description pid process target process

PID 4060 set thread context of 3772 4060 Factura comercial.exe Factura comercial.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

Factura comercial.exe

pid process

3772 Factura comercial.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Factura comercial.exe

description pid process

Token: SeDebugPrivilege 3772 Factura comercial.exe

description	pid	process	target process
PID 4060 set thread context of 3772	4060	Factura comercial.exe	Factura comercial.exe

pid	process
3772	Factura comercial.exe

description	pid	process
Token: SeDebugPrivilege	3772	Factura comercial.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Factura comercial.exe

description	pid	process	target process
PID 4060 wrote to memory of 3772	4060	Factura comercial.exe	Factura comercial.exe
PID 4060 wrote to memory of 3772	4060	Factura comercial.exe	Factura comercial.exe
PID 4060 wrote to memory of 3772	4060	Factura comercial.exe	Factura comercial.exe
PID 4060 wrote to memory of 3772	4060	Factura comercial.exe	Factura comercial.exe
PID 4060 wrote to memory of 3772	4060	Factura comercial.exe	Factura comercial.exe
PID 4060 wrote to memory of 3772	4060	Factura comercial.exe	Factura comercial.exe
PID 4060 wrote to memory of 3772	4060	Factura comercial.exe	Factura comercial.exe
PID 4060 wrote to memory of 3772	4060	Factura comercial.exe	Factura comercial.exe
PID 4060 wrote to memory of 3772	4060	Factura comercial.exe	Factura comercial.exe

memory/3772-124-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3772-125-0x00000000004139DE-mapping.dmp

Download
memory/3772-126-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4060-114-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/4060-116-0x0000000005170000-0x0000000005171000-memory.dmp

Filesize
4KB

Download
memory/4060-117-0x0000000004C70000-0x0000000004C71000-memory.dmp

Filesize
4KB

Download
memory/4060-118-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/4060-119-0x0000000004C70000-0x000000000516E000-memory.dmp

Filesize
5.0MB

Download
memory/4060-120-0x0000000004FF0000-0x0000000004FF2000-memory.dmp

Filesize
8KB

Download
memory/4060-121-0x00000000081E0000-0x00000000081E1000-memory.dmp

Filesize
4KB

Download
memory/4060-122-0x00000000067F0000-0x0000000006860000-memory.dmp

Filesize
448KB

Download
memory/4060-123-0x0000000006760000-0x0000000006782000-memory.dmp

Filesize
136KB

Download