lokibot | 8a0ad791edcb0ee362e6013e5b86204205b5869aae17294f14047ed26f1dddd2 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ZUZK0PMO.EXE
Size 1.3MB
Sample210706-1ncjsjftxe
SHA256 8a0ad791edcb0ee362e6013e5b86204205b5869aae17294f14047ed26f1dddd2
MD5 eb78191bde1949991aabf77ea599ea88
SHA1 f13acb0bc1bb00b5295b85ba27b9e27a1bffbfdb
SHA512 ea107d3cec5f56a547e23f212f84a9d40e88ad3825cc0e200e0237f078082d2cf30154706f2c9b088998a1bd9fab56164f391efaa1e21069fffcd0868e68a7f5
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://185.110.190.5/gugufdre.php/auJMYiGBL7JHG
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  ZUZK0PMO.EXE
- Size 1.3MB
- SHA256 8a0ad791edcb0ee362e6013e5b86204205b5869aae17294f14047ed26f1dddd2
- MD5 eb78191bde1949991aabf77ea599ea88
- SHA1 f13acb0bc1bb00b5295b85ba27b9e27a1bffbfdb
- SHA512 ea107d3cec5f56a547e23f212f84a9d40e88ad3825cc0e200e0237f078082d2cf30154706f2c9b088998a1bd9fab56164f391efaa1e21069fffcd0868e68a7f5
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan