lokibot | 35a3af18071ddc0f796d78dc7a0e93cee9d3878056e518c2f5fdf7b215f3bef2 | Triage™

Login
Reports

Overview

overview

Static

static

3

57c9ca749c...18.exe

windows7-x64

57c9ca749c...18.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target
57c9ca749c7bbd6539c40a5d7d3530a4_JaffaCakes118
Size 116KB
Sample240519-be85vaac46
SHA256 35a3af18071ddc0f796d78dc7a0e93cee9d3878056e518c2f5fdf7b215f3bef2
MD5 57c9ca749c7bbd6539c40a5d7d3530a4
SHA1 710ca10754ab027a9d1422fa2e9c852165c14ca1
SHA512 500477e1b875aaa87d9f044ac1d288130a4ef7f83df9e9f2a5862ffba613fd01b72efb674fa2562c9b4fa45e9a80a10741263964816035c0d8453fe173bb786f
SSDEEP 3072:mZCRGQOOr0mrYNRcDBPZmCHfRBKg37x2:mZkGQnfrYNm1ZmAf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot collection spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

57c9ca749c7bbd6539c40a5d7d3530a4_JaffaCakes118.exe

Resource

win7-20240508-en

windows7-x64

7 signatures

150 seconds

lokibot collection spyware stealer trojan

Behavioral task

behavioral2

Sample

57c9ca749c7bbd6539c40a5d7d3530a4_JaffaCakes118.exe

Resource

win10v2004-20240226-en

windows10-2004-x64

7 signatures

150 seconds

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

https://akonapis.cf/ssqq/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  57c9ca749c7bbd6539c40a5d7d3530a4_JaffaCakes118
- Size 116KB
- SHA256 35a3af18071ddc0f796d78dc7a0e93cee9d3878056e518c2f5fdf7b215f3bef2
- MD5 57c9ca749c7bbd6539c40a5d7d3530a4
- SHA1 710ca10754ab027a9d1422fa2e9c852165c14ca1
- SHA512 500477e1b875aaa87d9f044ac1d288130a4ef7f83df9e9f2a5862ffba613fd01b72efb674fa2562c9b4fa45e9a80a10741263964816035c0d8453fe173bb786f
- SSDEEP 3072:mZCRGQOOr0mrYNRcDBPZmCHfRBKg37x2:mZkGQnfrYNm1ZmAf
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

lokibotcollectionspywarestealertrojan

behavioral2

lokibotcollectionspywarestealertrojan

© 2018-2026

Terms | Privacy