lokibot | 5937bc1b0a10214a09f0bd7fd6987d42bba86748ce52bca41adfd8c7021ca6bd | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
5f81feea551373cd4f84f42112639e2f.exe
Size 434KB
Sample201209-akcjbaevaa
SHA256 5937bc1b0a10214a09f0bd7fd6987d42bba86748ce52bca41adfd8c7021ca6bd
MD5 5f81feea551373cd4f84f42112639e2f
SHA1 022e0771c6a113e7db22c2b767fd8c7463fbcbae
SHA512 5fca5bf76e9b05741ab558c2617b7333b2b07f6f1f8eddb9fb9362c8586d00cc21fc319f8259811936d7a7f1e3f9458de29457c3c99c028885116e6aba04d6db
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://forrastfoods.com/candy/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  5f81feea551373cd4f84f42112639e2f.exe
- Size 434KB
- SHA256 5937bc1b0a10214a09f0bd7fd6987d42bba86748ce52bca41adfd8c7021ca6bd
- MD5 5f81feea551373cd4f84f42112639e2f
- SHA1 022e0771c6a113e7db22c2b767fd8c7463fbcbae
- SHA512 5fca5bf76e9b05741ab558c2617b7333b2b07f6f1f8eddb9fb9362c8586d00cc21fc319f8259811936d7a7f1e3f9458de29457c3c99c028885116e6aba04d6db
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan