lokibot | c4e11fc875cebd67365c8db078cd7ff8b93b9583c7f34b3e098a94ef1c2b2326 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe
Size 1.1MB
Sample201109-mkrl5667ss
SHA256 c4e11fc875cebd67365c8db078cd7ff8b93b9583c7f34b3e098a94ef1c2b2326
MD5 a3aa6ff1adac984a3a06e52e22781d61
SHA1 fa15059d07c43ab25b097e4bfb757c02b476d05d
SHA512 202c046ebbbf29c2d0f3dad3a2dad244fedd73d8f173b1456060a6124e2b6aea06ff545447d11f1af349a6ac2edc0ef1fe2711f9b08f4ab02a7e71c5facf1fbd
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://attlogistics-vn.com/first/chief2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe
- Size 1.1MB
- SHA256 c4e11fc875cebd67365c8db078cd7ff8b93b9583c7f34b3e098a94ef1c2b2326
- MD5 a3aa6ff1adac984a3a06e52e22781d61
- SHA1 fa15059d07c43ab25b097e4bfb757c02b476d05d
- SHA512 202c046ebbbf29c2d0f3dad3a2dad244fedd73d8f173b1456060a6124e2b6aea06ff545447d11f1af349a6ac2edc0ef1fe2711f9b08f4ab02a7e71c5facf1fbd
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan