lokibot | 6ffa78774b2d87e1401cb4e2cc783597fab1666f19f25ce0dcdced717620000f | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Document_00067876.pdf.exe
Size 650KB
Sample210906-q4nyjabbf8
SHA256 6ffa78774b2d87e1401cb4e2cc783597fab1666f19f25ce0dcdced717620000f
MD5 04af7103bf3ab0c36a94401deb8964f4
SHA1 31e7acbff0bccba75558148e9461635f0b92b2d3
SHA512 72f316db457c47e65ba82f69cfd847d608f080713500d378cc2a24988c27cbe46c3046976bc9ec64d1172386c7a51db4ed8a9a7e8c3a813d90f90d8e8162ccc0
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://semkil.xyz/ee/cc/xx.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  Document_00067876.pdf.exe
- Size 650KB
- SHA256 6ffa78774b2d87e1401cb4e2cc783597fab1666f19f25ce0dcdced717620000f
- MD5 04af7103bf3ab0c36a94401deb8964f4
- SHA1 31e7acbff0bccba75558148e9461635f0b92b2d3
- SHA512 72f316db457c47e65ba82f69cfd847d608f080713500d378cc2a24988c27cbe46c3046976bc9ec64d1172386c7a51db4ed8a9a7e8c3a813d90f90d8e8162ccc0
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan