lokibot | e64b1e190d0586b444ffe00c8000df55893cb86939db1bad73d4b5449586973b | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PL.exe
Size 1.2MB
Sample210309-8tkc2c5b32
SHA256 e64b1e190d0586b444ffe00c8000df55893cb86939db1bad73d4b5449586973b
MD5 c3260321a6cc95d3c81b7e3e36d432aa
SHA1 052a306146265a6810244b8ebdc5052fbe26ce36
SHA512 db6a5347ab421064f35f5cf8de571da2998b36e1bc4af368c88d4e839366e03283573e16ef03c8462c1fa4c060d2d7215eb36c2367183be28b5e0075a5b08c46
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://bremileintl.ga/maka/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  PL.exe
- Size 1.2MB
- SHA256 e64b1e190d0586b444ffe00c8000df55893cb86939db1bad73d4b5449586973b
- MD5 c3260321a6cc95d3c81b7e3e36d432aa
- SHA1 052a306146265a6810244b8ebdc5052fbe26ce36
- SHA512 db6a5347ab421064f35f5cf8de571da2998b36e1bc4af368c88d4e839366e03283573e16ef03c8462c1fa4c060d2d7215eb36c2367183be28b5e0075a5b08c46
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan