lokibot | f3fd5ebe6540bda289db992910f051621df3b579c868d6f0c421168cb6db10bb | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
gunzipped
Size 582KB
Sample201109-cbwa18my2x
SHA256 f3fd5ebe6540bda289db992910f051621df3b579c868d6f0c421168cb6db10bb
MD5 68095eb10edecff494e68077b58339eb
SHA1 a7205a5258e3761c54b1b89eb817908ce55757fd
SHA512 d6e23702ae90026a5d0c660234e9df3a08f831e2580dfb4e5870b33a25f449f3925647b32a32402cb89a938202ed38d7c4fad2de9f2a5ed3183f4af73fcef0e0
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://pnkp.co.id/vvp/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  gunzipped
- Size 582KB
- SHA256 f3fd5ebe6540bda289db992910f051621df3b579c868d6f0c421168cb6db10bb
- MD5 68095eb10edecff494e68077b58339eb
- SHA1 a7205a5258e3761c54b1b89eb817908ce55757fd
- SHA512 d6e23702ae90026a5d0c660234e9df3a08f831e2580dfb4e5870b33a25f449f3925647b32a32402cb89a938202ed38d7c4fad2de9f2a5ed3183f4af73fcef0e0
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan