lokibot | bfcc16e302514e80fdc77675291f1bdb32796e7b77274f7596049938d0652347 | Triage™

Login
Reports

Overview

overview

Static

static

3

bfcc16e302...47.exe

windows7-x64

bfcc16e302...47.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target
bfcc16e302514e80fdc77675291f1bdb32796e7b77274f7596049938d0652347.exe
Size 164KB
Sample240926-ct3gaavdqa
SHA256 bfcc16e302514e80fdc77675291f1bdb32796e7b77274f7596049938d0652347
MD5 ed9fe2c20a68172921c064d0d9886b7b
SHA1 d892be8018cbc88b8cdd0db2338f643448630757
SHA512 8fdaaedc9585e72ebfdb8ba85e79f52614d9b3626327ac882cc4a2f108ed71335e013b173a628cd83135f8806644f9af4ac1f7026a4a0ae71f12057534269160
SSDEEP 3072:OgX3OY/NPH8Aq+XdOeuohMvEuf555vyWd+9MtGGE0vWGNF7owCCx7/WgafCzg:WOLOAhLuhvyi6GTb8wCC5/Wgb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot collection discovery spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

bfcc16e302514e80fdc77675291f1bdb32796e7b77274f7596049938d0652347.exe

Resource

win7-20240903-en

windows7-x64

8 signatures

150 seconds

lokibot collection discovery spyware stealer trojan

Behavioral task

behavioral2

Sample

bfcc16e302514e80fdc77675291f1bdb32796e7b77274f7596049938d0652347.exe

Resource

win10v2004-20240802-en

windows10-2004-x64

9 signatures

150 seconds

lokibot collection discovery spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

https://dddotx.shop/Mine/PWS/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  bfcc16e302514e80fdc77675291f1bdb32796e7b77274f7596049938d0652347.exe
- Size 164KB
- SHA256 bfcc16e302514e80fdc77675291f1bdb32796e7b77274f7596049938d0652347
- MD5 ed9fe2c20a68172921c064d0d9886b7b
- SHA1 d892be8018cbc88b8cdd0db2338f643448630757
- SHA512 8fdaaedc9585e72ebfdb8ba85e79f52614d9b3626327ac882cc4a2f108ed71335e013b173a628cd83135f8806644f9af4ac1f7026a4a0ae71f12057534269160
- SSDEEP 3072:OgX3OY/NPH8Aq+XdOeuohMvEuf555vyWd+9MtGGE0vWGNF7owCCx7/WgafCzg:WOLOAhLuhvyi6GTb8wCC5/Wgb
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection discovery spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

lokibotcollectiondiscoveryspywarestealertrojan

behavioral2

lokibotcollectiondiscoveryspywarestealertrojan

© 2018-2026

Terms | Privacy