lokibot | 6276ef565aebf223533b10f56f770550ff8bffdfba2799d4e9c379000d6fe44d | Triage™

Login
Reports

Overview

overview

Static

static

3

4cf0b6ea4f...18.exe

windows7-x64

4cf0b6ea4f...18.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target
4cf0b6ea4f05aff01254e851a0fc8a24_JaffaCakes118
Size 456KB
Sample240331-ex7lhsec42
SHA256 6276ef565aebf223533b10f56f770550ff8bffdfba2799d4e9c379000d6fe44d
MD5 4cf0b6ea4f05aff01254e851a0fc8a24
SHA1 9bbd12251e5e2f03b78637282818f4c3e86f8fce
SHA512 c8fcd60c174b56abdf7f1caec59116414f9113216412dceaf3b63796f714bb23519c53d519837fcde67a284b570d3e1af19d1fcaa5221c0c64ff5d7cf4b6ba56
SSDEEP 12288:MMASBfG1Ikii7u9CAJBu9BgXAuIkcoswa5A0:M6Bf2ni0AJ4/gLILZwa+0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot collection spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

4cf0b6ea4f05aff01254e851a0fc8a24_JaffaCakes118.exe

Resource

win7-20231129-en

windows7-x64

7 signatures

150 seconds

lokibot collection spyware stealer trojan

Behavioral task

behavioral2

Sample

4cf0b6ea4f05aff01254e851a0fc8a24_JaffaCakes118.exe

Resource

win10v2004-20240226-en

windows10-2004-x64

7 signatures

150 seconds

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://136.243.159.53/~element/page.php?id=491
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  4cf0b6ea4f05aff01254e851a0fc8a24_JaffaCakes118
- Size 456KB
- SHA256 6276ef565aebf223533b10f56f770550ff8bffdfba2799d4e9c379000d6fe44d
- MD5 4cf0b6ea4f05aff01254e851a0fc8a24
- SHA1 9bbd12251e5e2f03b78637282818f4c3e86f8fce
- SHA512 c8fcd60c174b56abdf7f1caec59116414f9113216412dceaf3b63796f714bb23519c53d519837fcde67a284b570d3e1af19d1fcaa5221c0c64ff5d7cf4b6ba56
- SSDEEP 12288:MMASBfG1Ikii7u9CAJBu9BgXAuIkcoswa5A0:M6Bf2ni0AJ4/gLILZwa+0
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

lokibotcollectionspywarestealertrojan

behavioral2

lokibotcollectionspywarestealertrojan

© 2018-2026

Terms | Privacy