lokibot | 4cc271a6df4a28ad8527132cd2ff5b6682dc4f8948233a450d251e48e5976204 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
kl4tJBxIAGQsw7X.exe
Size 344KB
Sample210820-jewaqkft6e
SHA256 4cc271a6df4a28ad8527132cd2ff5b6682dc4f8948233a450d251e48e5976204
MD5 0088e7505906e2b4e1cec18cc7f435e8
SHA1 948bd131dc8a5ed819274464a3ed4845ee81c780
SHA512 05fd09540916c6b0eeddac9d300daa1228b9d3d6e7ee5a6f3198435072ff123eb6facebdc2e832ca89574bd8565cb47f9985ac38402fa8f2bc7bc895c0c91dc0
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://fufux.xyz/io/cx/fi.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  kl4tJBxIAGQsw7X.exe
- Size 344KB
- SHA256 4cc271a6df4a28ad8527132cd2ff5b6682dc4f8948233a450d251e48e5976204
- MD5 0088e7505906e2b4e1cec18cc7f435e8
- SHA1 948bd131dc8a5ed819274464a3ed4845ee81c780
- SHA512 05fd09540916c6b0eeddac9d300daa1228b9d3d6e7ee5a6f3198435072ff123eb6facebdc2e832ca89574bd8565cb47f9985ac38402fa8f2bc7bc895c0c91dc0
- MD5 SHA1 SHA512
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

lokibotspywarestealertrojan

behavioral2

lokibotspywarestealertrojan