lokibot | 1264a71074a9c7b6e582a466b7b2d6c0fbfd6e04212a72bf75349b7c6e1b43c4

General

Target

Envío Airway Factura_.pdf.exe
Size

547KB
MD5

fce02d5ae70e73ef9e8d23fbc58c4796
SHA1

ee387ebd9710923fd37b16366c009848013701d4
SHA256

1264a71074a9c7b6e582a466b7b2d6c0fbfd6e04212a72bf75349b7c6e1b43c4
SHA512

8a317f6f9d9b9ac41766e1b28381ab84c0cb0e14a438210db1b7f6b822e2bf3c433737d9cc597c74c20fcde5e3706981faebc10f6c1e777563cd138fcee011a6

Score

10^/10

Family

lokibot

C2

http://ccjjlogsx.com/uu/me/ii.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata
Suspicious use of SetThreadContext 1 IoCs

Processes:

Envío Airway Factura_.pdf.exe

description pid process target process

PID 4800 set thread context of 636 4800 Envío Airway Factura_.pdf.exe Envío Airway Factura_.pdf.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

Envío Airway Factura_.pdf.exe

pid process

636 Envío Airway Factura_.pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Envío Airway Factura_.pdf.exe

description pid process

Token: SeDebugPrivilege 636 Envío Airway Factura_.pdf.exe

description	pid	process	target process
PID 4800 set thread context of 636	4800	Envío Airway Factura_.pdf.exe	Envío Airway Factura_.pdf.exe

pid	process
636	Envío Airway Factura_.pdf.exe

description	pid	process
Token: SeDebugPrivilege	636	Envío Airway Factura_.pdf.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Envío Airway Factura_.pdf.exe

description	pid	process	target process
PID 4800 wrote to memory of 636	4800	Envío Airway Factura_.pdf.exe	Envío Airway Factura_.pdf.exe
PID 4800 wrote to memory of 636	4800	Envío Airway Factura_.pdf.exe	Envío Airway Factura_.pdf.exe
PID 4800 wrote to memory of 636	4800	Envío Airway Factura_.pdf.exe	Envío Airway Factura_.pdf.exe
PID 4800 wrote to memory of 636	4800	Envío Airway Factura_.pdf.exe	Envío Airway Factura_.pdf.exe
PID 4800 wrote to memory of 636	4800	Envío Airway Factura_.pdf.exe	Envío Airway Factura_.pdf.exe
PID 4800 wrote to memory of 636	4800	Envío Airway Factura_.pdf.exe	Envío Airway Factura_.pdf.exe
PID 4800 wrote to memory of 636	4800	Envío Airway Factura_.pdf.exe	Envío Airway Factura_.pdf.exe
PID 4800 wrote to memory of 636	4800	Envío Airway Factura_.pdf.exe	Envío Airway Factura_.pdf.exe
PID 4800 wrote to memory of 636	4800	Envío Airway Factura_.pdf.exe	Envío Airway Factura_.pdf.exe

memory/636-124-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/636-125-0x00000000004139DE-mapping.dmp

Download
memory/636-126-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4800-114-0x0000000000870000-0x0000000000871000-memory.dmp

Filesize
4KB

Download
memory/4800-116-0x0000000005860000-0x0000000005861000-memory.dmp

Filesize
4KB

Download
memory/4800-117-0x0000000005260000-0x0000000005261000-memory.dmp

Filesize
4KB

Download
memory/4800-118-0x0000000005360000-0x000000000585E000-memory.dmp

Filesize
5.0MB

Download
memory/4800-119-0x0000000005320000-0x0000000005321000-memory.dmp

Filesize
4KB

Download
memory/4800-120-0x00000000057E0000-0x00000000057E2000-memory.dmp

Filesize
8KB

Download
memory/4800-121-0x00000000088E0000-0x00000000088E1000-memory.dmp

Filesize
4KB

Download
memory/4800-122-0x0000000006EE0000-0x0000000006F4E000-memory.dmp

Filesize
440KB

Download
memory/4800-123-0x0000000007080000-0x00000000070A2000-memory.dmp

Filesize
136KB

Download