lokibot | e4c96e573cf689f5b8a8857995cf3216e89f4f0529334e0eafa611e9c775bbd2 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
31ff33110c9bb8f01cc0998eaf5320f2
Size 1019KB
Sample201117-48ntndd8te
SHA256 e4c96e573cf689f5b8a8857995cf3216e89f4f0529334e0eafa611e9c775bbd2
MD5 31ff33110c9bb8f01cc0998eaf5320f2
SHA1 8d8b239c3677bf1ab4c2ad44c55114199033fc78
SHA512 742a11f1c447f5c5d6257f83552277a1320c7188aea3fcb8cbeb73ab752772a81cea913ffa1403ca835dbd58ede407d42a7d87c69a6512c112b5ff571ee85e03
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://yonwoo-rnold.com/bukisloki/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  31ff33110c9bb8f01cc0998eaf5320f2
- Size 1019KB
- SHA256 e4c96e573cf689f5b8a8857995cf3216e89f4f0529334e0eafa611e9c775bbd2
- MD5 31ff33110c9bb8f01cc0998eaf5320f2
- SHA1 8d8b239c3677bf1ab4c2ad44c55114199033fc78
- SHA512 742a11f1c447f5c5d6257f83552277a1320c7188aea3fcb8cbeb73ab752772a81cea913ffa1403ca835dbd58ede407d42a7d87c69a6512c112b5ff571ee85e03
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

lokibotspywarestealertrojan