Overview

overview

10

Static

static

feKIyfpdldOh6iN.exe

windows7_x64

10

feKIyfpdldOh6iN.exe

windows10_x64

10

Resubmissions

23-10-2024 01:15

241023-bmdznswajn 10

16-08-2021 17:42

210816-hqx927bwbx 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    feKIyfpdldOh6iN.exe

  • Size

    586KB

  • Sample

    210816-hqx927bwbx

  • MD5

    65715e10ea8ea3f0944fa0d4f7769266

  • SHA1

    e99fb439022d9c2ad1102ee67c624211b8131eb2

  • SHA256

    a6ebe80f6fefcf709347f986ff5c913d0be43d98b693f18c363a2d4293d5c17a

  • SHA512

    a797402c5ff58bf214c50243bdefe4c3f25be779766f19c02d459e654c695e66abbd1fb64470515374f47f05827ade29db8d1d4f5028bdfb91ed9efeb18a0913

Score
10/10
lokibotspywarestealersuricatatrojan

Malware Config

Extracted

Family

lokibot

C2

http://fufux.xyz/io/cx/fi.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      feKIyfpdldOh6iN.exe

    • Size

      586KB

    • MD5

      65715e10ea8ea3f0944fa0d4f7769266

    • SHA1

      e99fb439022d9c2ad1102ee67c624211b8131eb2

    • SHA256

      a6ebe80f6fefcf709347f986ff5c913d0be43d98b693f18c363a2d4293d5c17a

    • SHA512

      a797402c5ff58bf214c50243bdefe4c3f25be779766f19c02d459e654c695e66abbd1fb64470515374f47f05827ade29db8d1d4f5028bdfb91ed9efeb18a0913

    Score
    10/10
    lokibotspywarestealersuricatatrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • suricata: ET MALWARE LokiBot Checkin

      suricata: ET MALWARE LokiBot Checkin

      suricata

    • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

      suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

      suricata

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks