lokibot | 03cb95fdd2bb94ff411d1737206768638ad47e1a0a52a31f8b697dc6a827fc48 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
gunzipped.exe
Size 305KB
Sample210913-fx5mlachf8
SHA256 03cb95fdd2bb94ff411d1737206768638ad47e1a0a52a31f8b697dc6a827fc48
MD5 01fe8dea3052e01136d2e8bb7ab75fb9
SHA1 a68e6bd940df95fdafd67e6cbacff5d4995c616c
SHA512 1b90cf544811c1e23935ececcf4aaf794dafa47f8b023d2baf2d966ae93b54f6ab31950b213b1250df31acc28b972acdfebe072371edee09fb6bf609e2ce5f9b
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

https://www.skscarsrjn.in/wp/zaq/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  gunzipped.exe
- Size 305KB
- SHA256 03cb95fdd2bb94ff411d1737206768638ad47e1a0a52a31f8b697dc6a827fc48
- MD5 01fe8dea3052e01136d2e8bb7ab75fb9
- SHA1 a68e6bd940df95fdafd67e6cbacff5d4995c616c
- SHA512 1b90cf544811c1e23935ececcf4aaf794dafa47f8b023d2baf2d966ae93b54f6ab31950b213b1250df31acc28b972acdfebe072371edee09fb6bf609e2ce5f9b
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan