lokibot | b61fbf292115599e5715c9a9fcbbb8b8f6cf630f3f98485f736a4ea70fdb53f1 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
2b326b2abdfd2dfee14c8b392a7c361d.exe
Size 794KB
Sample210811-vy86n67ex2
SHA256 b61fbf292115599e5715c9a9fcbbb8b8f6cf630f3f98485f736a4ea70fdb53f1
MD5 2b326b2abdfd2dfee14c8b392a7c361d
SHA1 868d0f6a4016e39e0a2396f14e1918964483cbd5
SHA512 3606a0efab406ef9a3dfc99e5d8e1bc9e8c2b3960f822934f8a1a1afcd9138b45fcd2d75cbf2572c1405052e8fa253845e651ca123bdf93534720ecdac3fda2a
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://manvim.co/fd14/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  2b326b2abdfd2dfee14c8b392a7c361d.exe
- Size 794KB
- SHA256 b61fbf292115599e5715c9a9fcbbb8b8f6cf630f3f98485f736a4ea70fdb53f1
- MD5 2b326b2abdfd2dfee14c8b392a7c361d
- SHA1 868d0f6a4016e39e0a2396f14e1918964483cbd5
- SHA512 3606a0efab406ef9a3dfc99e5d8e1bc9e8c2b3960f822934f8a1a1afcd9138b45fcd2d75cbf2572c1405052e8fa253845e651ca123bdf93534720ecdac3fda2a
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan