lokibot | a1b2f21597f29eb7a637a8d5bc717abdd8a532724db22c41dcfe1806f8e6fb36 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
gunzipped.exe
Size 1.0MB
Sample210329-vrv4etwpgn
SHA256 a1b2f21597f29eb7a637a8d5bc717abdd8a532724db22c41dcfe1806f8e6fb36
MD5 bbc48f1b529687c6b7ef82af9ce9a8dc
SHA1 10db06f711173311cdc8191fbd0783c676c35c2f
SHA512 3e98c721bbd148c6b7c94a5b017808ba3d7dfac8920ded6f1741932f617952152e7fdb1cd1e24142afe9be69faa283a9bb345bfd291da8b6defb6fd23afc93d3
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://chem.buet.ac.bd/ox/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  gunzipped.exe
- Size 1.0MB
- SHA256 a1b2f21597f29eb7a637a8d5bc717abdd8a532724db22c41dcfe1806f8e6fb36
- MD5 bbc48f1b529687c6b7ef82af9ce9a8dc
- SHA1 10db06f711173311cdc8191fbd0783c676c35c2f
- SHA512 3e98c721bbd148c6b7c94a5b017808ba3d7dfac8920ded6f1741932f617952152e7fdb1cd1e24142afe9be69faa283a9bb345bfd291da8b6defb6fd23afc93d3
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan