lokibot | b5c99c0df0b6c4cd43071e30be30139ef8474c85c8a6a874b2ae68f761faba1a | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Spare Parts (KITO) .exe
Size 678KB
Sample210510-rtxwlpn1fs
SHA256 b5c99c0df0b6c4cd43071e30be30139ef8474c85c8a6a874b2ae68f761faba1a
MD5 e49e50cd59695ff18f63efb252a35b24
SHA1 91019efad11a5c1cc658bc3c7ab4c8db9d4581db
SHA512 1fa0f7d4b0bb2a467a68ff74704595c0250f33bf4db2df628086761234cc2009075f451dfe1aea446985b260154f98bf09f34b6d7d17c8ec7db20b86fd1a13cf
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://173.208.204.37/k.php/L8iCsSGXCVazg
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  Spare Parts (KITO) .exe
- Size 678KB
- SHA256 b5c99c0df0b6c4cd43071e30be30139ef8474c85c8a6a874b2ae68f761faba1a
- MD5 e49e50cd59695ff18f63efb252a35b24
- SHA1 91019efad11a5c1cc658bc3c7ab4c8db9d4581db
- SHA512 1fa0f7d4b0bb2a467a68ff74704595c0250f33bf4db2df628086761234cc2009075f451dfe1aea446985b260154f98bf09f34b6d7d17c8ec7db20b86fd1a13cf
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan