lokibot | 1264a71074a9c7b6e582a466b7b2d6c0fbfd6e04212a72bf75349b7c6e1b43c4

General

Target

Envío Airway Factura_.pdf.exe
Size

547KB
MD5

fce02d5ae70e73ef9e8d23fbc58c4796
SHA1

ee387ebd9710923fd37b16366c009848013701d4
SHA256

1264a71074a9c7b6e582a466b7b2d6c0fbfd6e04212a72bf75349b7c6e1b43c4
SHA512

8a317f6f9d9b9ac41766e1b28381ab84c0cb0e14a438210db1b7f6b822e2bf3c433737d9cc597c74c20fcde5e3706981faebc10f6c1e777563cd138fcee011a6

Score

10^/10

Family

lokibot

C2

http://ccjjlogsx.com/uu/me/ii.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata
Suspicious use of SetThreadContext 1 IoCs

Processes:

Envío Airway Factura_.pdf.exe

description pid process target process

PID 452 set thread context of 1696 452 Envío Airway Factura_.pdf.exe Envío Airway Factura_.pdf.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

Envío Airway Factura_.pdf.exe

pid process

1696 Envío Airway Factura_.pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Envío Airway Factura_.pdf.exe

description pid process

Token: SeDebugPrivilege 1696 Envío Airway Factura_.pdf.exe

description	pid	process	target process
PID 452 set thread context of 1696	452	Envío Airway Factura_.pdf.exe	Envío Airway Factura_.pdf.exe

pid	process
1696	Envío Airway Factura_.pdf.exe

description	pid	process
Token: SeDebugPrivilege	1696	Envío Airway Factura_.pdf.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Envío Airway Factura_.pdf.exe

description	pid	process	target process
PID 452 wrote to memory of 1696	452	Envío Airway Factura_.pdf.exe	Envío Airway Factura_.pdf.exe
PID 452 wrote to memory of 1696	452	Envío Airway Factura_.pdf.exe	Envío Airway Factura_.pdf.exe
PID 452 wrote to memory of 1696	452	Envío Airway Factura_.pdf.exe	Envío Airway Factura_.pdf.exe
PID 452 wrote to memory of 1696	452	Envío Airway Factura_.pdf.exe	Envío Airway Factura_.pdf.exe
PID 452 wrote to memory of 1696	452	Envío Airway Factura_.pdf.exe	Envío Airway Factura_.pdf.exe
PID 452 wrote to memory of 1696	452	Envío Airway Factura_.pdf.exe	Envío Airway Factura_.pdf.exe
PID 452 wrote to memory of 1696	452	Envío Airway Factura_.pdf.exe	Envío Airway Factura_.pdf.exe
PID 452 wrote to memory of 1696	452	Envío Airway Factura_.pdf.exe	Envío Airway Factura_.pdf.exe
PID 452 wrote to memory of 1696	452	Envío Airway Factura_.pdf.exe	Envío Airway Factura_.pdf.exe
PID 452 wrote to memory of 1696	452	Envío Airway Factura_.pdf.exe	Envío Airway Factura_.pdf.exe

memory/452-60-0x0000000000840000-0x0000000000841000-memory.dmp

Filesize
4KB

Download
memory/452-62-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Filesize
4KB

Download
memory/452-63-0x0000000000330000-0x0000000000332000-memory.dmp

Filesize
8KB

Download
memory/452-64-0x00000000050E0000-0x000000000514E000-memory.dmp

Filesize
440KB

Download
memory/452-65-0x0000000000770000-0x0000000000792000-memory.dmp

Filesize
136KB

Download
memory/1696-66-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1696-67-0x00000000004139DE-mapping.dmp

Download
memory/1696-68-0x00000000753E1000-0x00000000753E3000-memory.dmp

Filesize
8KB

Download
memory/1696-69-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download