lokibot | 8019700bd27aecf2c5a6874494f5d897aea450cfe806435f7fe28680487dcc8a | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
2f9a3838a5e153988e20ed0e8729739d.exe
Size 1.3MB
Sample201109-xdwca4pvps
SHA256 8019700bd27aecf2c5a6874494f5d897aea450cfe806435f7fe28680487dcc8a
MD5 2f9a3838a5e153988e20ed0e8729739d
SHA1 9e66a93233d1d6cbcedfda1b5bb3168fc052dff7
SHA512 e60032c0e18a4dc8c5e655b95249df0ed3ac15e23003e2e9b087c576aa0f28ee575002b31255b797aabc39d547e4f452db2f891a41c3cbf6d114c2c97f0cab4c
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://b2bseller.ga/choolee/gate.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  2f9a3838a5e153988e20ed0e8729739d.exe
- Size 1.3MB
- SHA256 8019700bd27aecf2c5a6874494f5d897aea450cfe806435f7fe28680487dcc8a
- MD5 2f9a3838a5e153988e20ed0e8729739d
- SHA1 9e66a93233d1d6cbcedfda1b5bb3168fc052dff7
- SHA512 e60032c0e18a4dc8c5e655b95249df0ed3ac15e23003e2e9b087c576aa0f28ee575002b31255b797aabc39d547e4f452db2f891a41c3cbf6d114c2c97f0cab4c
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan