lokibot | 445e1ae4fb515ce4fca81255fc4f569ba238d2a7b3ba0c093f4d55bc8fa5ae08 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
MOM Daily attendance uodate formÂ·pdf.exe
Size 403KB
Sample210119-61ytxynhz2
SHA256 445e1ae4fb515ce4fca81255fc4f569ba238d2a7b3ba0c093f4d55bc8fa5ae08
MD5 66d95510f3a550106e1bd6d3dd187865
SHA1 e34b1e0c2813bf540a7d3c5e8d0cfecfe5fec164
SHA512 0fc5b7e44c340f39d64a274656843198a672794647af03b5d554701eb2e069d44c52968b1d2c984878228c2fb6ee148be5ab2bfd7c107fe1506efbdf2eed5c49
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://51.195.53.221/p.php/pXqVbj1ory8MD
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  MOM Daily attendance uodate formÂ·pdf.exe
- Size 403KB
- SHA256 445e1ae4fb515ce4fca81255fc4f569ba238d2a7b3ba0c093f4d55bc8fa5ae08
- MD5 66d95510f3a550106e1bd6d3dd187865
- SHA1 e34b1e0c2813bf540a7d3c5e8d0cfecfe5fec164
- SHA512 0fc5b7e44c340f39d64a274656843198a672794647af03b5d554701eb2e069d44c52968b1d2c984878228c2fb6ee148be5ab2bfd7c107fe1506efbdf2eed5c49
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan