lokibot | 2930914bc63c783bbc65b626693ded3f2cf10d4394b0919451eec85098fb18c5 | Triage

Sharing

General

Target

7ec76f62130e62ace68487f4db27c7f7_JaffaCakes118
Size

411KB
Sample

240528-3jr6nsha6x
MD5

7ec76f62130e62ace68487f4db27c7f7
SHA1

01ec7f00bdfffcd2c230459431568e18ff242013
SHA256

2930914bc63c783bbc65b626693ded3f2cf10d4394b0919451eec85098fb18c5
SHA512

b1aa19bbd5839dd1ba8edbd957d230ff4652a3dfed72234b52876be03a19803097aee547d5827575af8568ae3c02601c57ff8877ac9465f5f05392333773b67b
SSDEEP

6144:nV273xrOz9q5JAp6rjLcXXS5e73claQv8sn6snOB5JZ4AsCroOgDni:nV2V6z9q5Q6r/cS5eolL03cOBlvspDi

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://141.105.64.140/bk/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  7ec76f62130e62ace68487f4db27c7f7_JaffaCakes118
- Size
  
  411KB
- MD5
  
  7ec76f62130e62ace68487f4db27c7f7
- SHA1
  
  01ec7f00bdfffcd2c230459431568e18ff242013
- SHA256
  
  2930914bc63c783bbc65b626693ded3f2cf10d4394b0919451eec85098fb18c5
- SHA512
  
  b1aa19bbd5839dd1ba8edbd957d230ff4652a3dfed72234b52876be03a19803097aee547d5827575af8568ae3c02601c57ff8877ac9465f5f05392333773b67b
- SSDEEP
  
  6144:nV273xrOz9q5JAp6rjLcXXS5e73claQv8sn6snOB5JZ4AsCroOgDni:nV2V6z9q5Q6r/cS5eolL03cOBlvspDi
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

lokibotspywarestealertrojan