lokibot | hxxp://198[.]46[.]132[.]159/www/vbc[.]exe | Triage

Submit
Reports

Overview

overview

Static

static

URLScan

urlscan

http://198.46.132.15...

windows10_x64

Sharing

General

Target

http://198.46.132.159/www/vbc.exe
Sample

210727-j55rawjdj2

Score

10^/10

lokibot spyware stealer suricata trojan

Static task

static1

URLScan task

urlscan1

Sample

http://198.46.132.159/www/vbc.exe

Behavioral task

behavioral1

Sample

http://198.46.132.159/www/vbc.exe

Resource

win10v20210408

lokibot spyware stealer suricata trojan

windows10_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

lokibot

C2

http://asiatrans.cf/BN1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  http://198.46.132.159/www/vbc.exe
Score

10^/10

lokibot spyware stealer suricata trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata
- Downloads MZ/PE file
- Executes dropped EXE
- Uses the VBS compiler for execution
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

urlscan1

behavioral1

lokibotspywarestealersuricatatrojan

© 2018-2024

Terms | Privacy