lokibot | 7061a7e7eae6b604db3f6f32ba594daf03f368078dfbe970b3c982f34070cd97 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
NFW5onL8M3mNs2C.exe
Size 658KB
Sample210715-zwp2ed5h4n
SHA256 7061a7e7eae6b604db3f6f32ba594daf03f368078dfbe970b3c982f34070cd97
MD5 9106a7e1057aa7c40d8b0ef560eb5451
SHA1 efe2f65f03ee80d46f6c1e6c12a9e20fd1718448
SHA512 3e2153000dd08c5974d575c9ea31e0d8c53928d731f3a4fa767866e8e59ebbeaf5787901bc010ca73e41996e0c90a48a7b76fc27a9ce6f1282b0ffe10e3d2c21
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://zascocs.xyz/cd/ui/fo.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  NFW5onL8M3mNs2C.exe
- Size 658KB
- SHA256 7061a7e7eae6b604db3f6f32ba594daf03f368078dfbe970b3c982f34070cd97
- MD5 9106a7e1057aa7c40d8b0ef560eb5451
- SHA1 efe2f65f03ee80d46f6c1e6c12a9e20fd1718448
- SHA512 3e2153000dd08c5974d575c9ea31e0d8c53928d731f3a4fa767866e8e59ebbeaf5787901bc010ca73e41996e0c90a48a7b76fc27a9ce6f1282b0ffe10e3d2c21
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan