English
English Indonesia Türkçe Deutsch Español Português Pусский Français Italiano Nederlands Polski العربية ไทย Tiếng Việt 繁體中文 简体中文 日本語 한국어

#lokibot search results

kienbigmummy's profile picture. Work hard in silence , let success make the noise.
m4n0w4r
 @kienbigmummy
Feb 21, 2023

🔥An email related to VN spreads #LokiBot ✉️hash:88b508f0e10b580ca93c71938b3b6eb97b39a3f3b5cc50b6e8ce855d4bdd3709 IOCs: ☠️103[.]140.251.225 🌐http://eyecos[.]ga/kung/gate.php

kienbigmummy's tweet image. 🔥An email related to VN spreads #LokiBot ✉️hash:88b508f0e10b580ca93c71938b3b6eb97b39a3f3b5cc50b6e8ce855d4bdd3709 IOCs: ☠️103[.]140.251.225 🌐http://eyecos[.]ga/kung/gate.php
1
19
41
5
7K
cyberfeeddigest's profile picture. I deliver daily #DarkWeb ,#DeepWeb and #CTI feeds,and a bit of geopolitical clashes #Darkweb #Deepweb #Ransomware #Malware #Databreach #CTI #ThreatIntel
darkweb-deepwebfeed
 @cyberfeeddigest
Oct 14

🛑 'Loki Bot' Listing — CVV Shop Sells Android Loki Bot A CVV marketplace is advertising an advanced Android stealer (card grabber, SMS/USSD intercept, screen locker, contacts & app harvesting, and...). Handle with extreme caution — for #Malware analysts #LokiBot #CyberCrime

cyberfeeddigest's tweet image. 🛑 'Loki Bot' Listing — CVV Shop Sells Android Loki Bot A CVV marketplace is advertising an advanced Android stealer (card grabber, SMS/USSD intercept, screen locker, contacts & app harvesting, and...). Handle with extreme caution — for #Malware analysts #LokiBot #CyberCrime
0
4
18
5
2K
Gi7w0rm's profile picture. Threat Intelligence Analyst | See my Linktree for other socials | In case I post false intel, contact me! Support me: https://t.co/5WgDqr0K8p 🇪🇺🇩🇪🇺🇦🌈
Gi7w0rm
 @Gi7w0rm
Oct 12, 2023

What a beautiful way to start the day :) #Lokibot #panel #itw

Gi7w0rm's tweet image. What a beautiful way to start the day :) #Lokibot #panel #itw
2
3
53
8
8K
Jane_0sint's profile picture. Network traffic numismatist 🔎
Jane
@Jane_0sint
Aug 14, 2023

A simple and rarely seen example of extracting data stolen by a #lokibot, not that it's a big deal, but it might come in handy for someone💁‍♀️

Jane_0sint's tweet image. A simple and rarely seen example of extracting data stolen by a #lokibot, not that it's a big deal, but it might come in handy for someone💁‍♀️
Jane_0sint's tweet image. A simple and rarely seen example of extracting data stolen by a #lokibot, not that it's a big deal, but it might come in handy for someone💁‍♀️
anyrun_app's profile picture. Empowering businesses with proactive security solutions: Interactive Sandbox, TI Lookup and Feeds. Sign up: https://t.co/8hIX0Qh5ME
ANY.RUN
@anyrun_app
Aug 14, 2023

#LokiBot is one of the most enduring credential stealers. On ANYRUN, the first tag for LokiBot was applied on March 6, 2018, making it one of the first public submissions. 🟥 - The aPLib compression algorithm is used to compress the decoded exfiltrated data and credentials from…

anyrun_app's tweet image. #LokiBot is one of the most enduring credential stealers. On ANYRUN, the first tag for LokiBot was applied on March 6, 2018, making it one of the first public submissions. 🟥 - The aPLib compression algorithm is used to compress the decoded exfiltrated data and credentials from…
anyrun_app's tweet image. #LokiBot is one of the most enduring credential stealers. On ANYRUN, the first tag for LokiBot was applied on March 6, 2018, making it one of the first public submissions. 🟥 - The aPLib compression algorithm is used to compress the decoded exfiltrated data and credentials from…
0
10
21
0
9K
0
13
31
1
4K
kienbigmummy's profile picture. Work hard in silence , let success make the noise.
m4n0w4r
 @kienbigmummy
Feb 7, 2023

🔥 An email spreads #LokiBot ✉️hash: 55f21edd4d3d287b961b57d6215a809cc06fe00c8f649ed812522b8061276409 IOCs: 📄http://192[.]3.223.114/77.doc 👹http://192[.]3.223.114/477/vbc.exe 🌐http://sempersim[.]su/ha1/fre.php

kienbigmummy's tweet image. 🔥 An email spreads #LokiBot ✉️hash: 55f21edd4d3d287b961b57d6215a809cc06fe00c8f649ed812522b8061276409 IOCs: 📄http://192[.]3.223.114/77.doc 👹http://192[.]3.223.114/477/vbc.exe 🌐http://sempersim[.]su/ha1/fre.php
2
18
44
4
6K
kienbigmummy's profile picture. Work hard in silence , let success make the noise.
m4n0w4r
 @kienbigmummy
Feb 15, 2023

🔥An email spreads #LokiBot was submitted to VT from VN! ✉️hash: 5df9df2e1b4aeec1b8036c627dcaeffb049853d2f1c6bcf83109e541c36a46ac IOCs: 🐛http://195[.]133.40.108/explorer/.win32.exe 🌐http://sempersim[.]su/ha19/fre.php

kienbigmummy's tweet image. 🔥An email spreads #LokiBot was submitted to VT from VN! ✉️hash: 5df9df2e1b4aeec1b8036c627dcaeffb049853d2f1c6bcf83109e541c36a46ac IOCs: 🐛http://195[.]133.40.108/explorer/.win32.exe 🌐http://sempersim[.]su/ha19/fre.php
1
12
31
1
4K
kienbigmummy's profile picture. Work hard in silence , let success make the noise.
m4n0w4r
 @kienbigmummy
Mar 4, 2023

🔥An email sample related to VN spreads #Lokibot ✉️hash:cb87ec5825659ec1919ac6ffdec4b88e4336c0be420c726ceab1917689fdd161 IOCs: ☠️107[.]175.212.18 🌐http://185[.]246.220.60/shen/five/fre.php

kienbigmummy's tweet image. 🔥An email sample related to VN spreads #Lokibot ✉️hash:cb87ec5825659ec1919ac6ffdec4b88e4336c0be420c726ceab1917689fdd161 IOCs: ☠️107[.]175.212.18 🌐http://185[.]246.220.60/shen/five/fre.php
kienbigmummy's tweet image. 🔥An email sample related to VN spreads #Lokibot ✉️hash:cb87ec5825659ec1919ac6ffdec4b88e4336c0be420c726ceab1917689fdd161 IOCs: ☠️107[.]175.212.18 🌐http://185[.]246.220.60/shen/five/fre.php
0
11
27
4
5K
kienbigmummy's profile picture. Work hard in silence , let success make the noise.
m4n0w4r
 @kienbigmummy
Jun 6, 2023

🔥 An email sample spreads #LokiBot was submitted from VN! ✉️27011215dce27a21aaa6a08898f11672 🐛93ed842119d52c8104eba8c1d3cbfe8e IOCs: 🌐http://161[.]35.102.56/~nikol/?p=314875839320

kienbigmummy's tweet image. 🔥 An email sample spreads #LokiBot was submitted from VN! ✉️27011215dce27a21aaa6a08898f11672 🐛93ed842119d52c8104eba8c1d3cbfe8e IOCs: 🌐http://161[.]35.102.56/~nikol/?p=314875839320
kienbigmummy's tweet image. 🔥 An email sample spreads #LokiBot was submitted from VN! ✉️27011215dce27a21aaa6a08898f11672 🐛93ed842119d52c8104eba8c1d3cbfe8e IOCs: 🌐http://161[.]35.102.56/~nikol/?p=314875839320
0
8
32
5
3K
58_158_177_102's profile picture. 企業のCSIRTの人兼企業のCTOの人。シンクホールは趣味。書き込む内容は所属に関係しているものもありますが、意見や見解は個人的なもの。意識低い低い系/User side Cyber Security Researcher & sinkholer
moto_sato
@58_158_177_102
Apr 3, 2024

日本語マルウェアメールの接到を確認しています。 #malspam in Japanese #guloader #Lokibot 件名 : RV: 価格のリクエスト // TODAI OC 26357 File name : TODAI OC 26357.7z MD5 : 92b88a1994ff2642ef9f74d419843b6e Payload ffrom :…

58_158_177_102's tweet image. 日本語マルウェアメールの接到を確認しています。 #malspam in Japanese #guloader #Lokibot 件名 : RV: 価格のリクエスト // TODAI OC 26357 File name : TODAI OC 26357.7z MD5 : 92b88a1994ff2642ef9f74d419843b6e Payload ffrom :…
1
13
25
7
10K
ptswarm's profile picture. Positive Technologies Offensive Team
PT SWARM
 @ptswarm
Dec 19

🇻🇳 From Positive Hack Talks in Hanoi: @kienbigmummy on using IDA AppCall to deobfuscate malware! Learn how to: 1⃣ Recover hidden WinAPI names (e.g., #LokiBot) 2⃣ Extract strings & C&C addresses (e.g., #Emotet) Applicable to your samples! The slides 👉 static.ptsecurity.com/events/empower…

ptswarm's tweet image. 🇻🇳 From Positive Hack Talks in Hanoi: @kienbigmummy on using IDA AppCall to deobfuscate malware! Learn how to: 1⃣ Recover hidden WinAPI names (e.g., #LokiBot) 2⃣ Extract strings & C&C addresses (e.g., #Emotet) Applicable to your samples! The slides 👉 static.ptsecurity.com/events/empower…
0
8
28
8
5K
kienbigmummy's profile picture. Work hard in silence , let success make the noise.
m4n0w4r
 @kienbigmummy
Dec 3, 2023

🔥New #maldoc spreads #LokiBot was submitted to VT from VN 🇻🇳! 📃hash:6be525d464e45656332ec814975fbced53acfc8ff7ba0e165f2c66c85df47e20 ☠️IOCs: 👹http://23[.]227.196.204/Newfold/ansi.exe 💀23[.]227.196.204 🌐http://sempersim[.]su/a14/fre.php

kienbigmummy's tweet image. 🔥New #maldoc spreads #LokiBot was submitted to VT from VN 🇻🇳! 📃hash:6be525d464e45656332ec814975fbced53acfc8ff7ba0e165f2c66c85df47e20 ☠️IOCs: 👹http://23[.]227.196.204/Newfold/ansi.exe 💀23[.]227.196.204 🌐http://sempersim[.]su/a14/fre.php
0
7
33
2
2K
kienbigmummy's profile picture. Work hard in silence , let success make the noise.
m4n0w4r
 @kienbigmummy
Mar 13, 2023

🔥Maldoc sample spreads #LokiBot was submitted to VT from VN!! 📄hash:e1d6c159c4e0b5d404d763846914c1b33b26591fd4100da3235335889f6a9407 IOCs: 👹http://103[.]167.92.45/kung/GG18.exe 🌐http://171[.]22.30.164/kung/five/fre.php

kienbigmummy's tweet image. 🔥Maldoc sample spreads #LokiBot was submitted to VT from VN!! 📄hash:e1d6c159c4e0b5d404d763846914c1b33b26591fd4100da3235335889f6a9407 IOCs: 👹http://103[.]167.92.45/kung/GG18.exe 🌐http://171[.]22.30.164/kung/five/fre.php
kienbigmummy's tweet image. 🔥Maldoc sample spreads #LokiBot was submitted to VT from VN!! 📄hash:e1d6c159c4e0b5d404d763846914c1b33b26591fd4100da3235335889f6a9407 IOCs: 👹http://103[.]167.92.45/kung/GG18.exe 🌐http://171[.]22.30.164/kung/five/fre.php
1
7
17
3
3K
ShanHolo's profile picture. Another blue team member…..#CSIRT #DFIR #Malware #4n6 #ThreatIntel and following the white rabbit...
Shanholo
 @ShanHolo
Jul 23, 2024

🚨#Opendir #Malware 🚨 🧵1/2 hxxp://198.46.178.229/55433/ ⚠️#Lokibot #Stealer winiti.exe➡️MD5:33f3dc03864d8d5cce813683d49ad2dd 📡5 C2: hxxp://overclockingmachines.info/bally/fre.php hxxp://kbfvzoboss.bid/alien/fre.php hxxp://alphastand.trade/alien/fre.php

ShanHolo's tweet image. 🚨#Opendir #Malware 🚨 🧵1/2 hxxp://198.46.178.229/55433/ ⚠️#Lokibot #Stealer winiti.exe➡️MD5:33f3dc03864d8d5cce813683d49ad2dd 📡5 C2: hxxp://overclockingmachines.info/bally/fre.php hxxp://kbfvzoboss.bid/alien/fre.php hxxp://alphastand.trade/alien/fre.php
1
1
5
1
403
cyberfeeddigest's profile picture. I deliver daily #DarkWeb ,#DeepWeb and #CTI feeds,and a bit of geopolitical clashes #Darkweb #Deepweb #Ransomware #Malware #Databreach #CTI #ThreatIntel
darkweb-deepwebfeed
 @cyberfeeddigest
Dec 4

#LOKIBOT Alert: A #Malicious Domain Identified 🚨 Domain: sodiumlaurethsulfatedesyroyer[.]com 🛑 Flagged by 13/96 security vendors as malicious. 💻 What is Lokibot? A sophisticated banking trojan targeting Windows: Steals login credentials, financial info & sensitive data.…

cyberfeeddigest's tweet image. #LOKIBOT Alert: A #Malicious Domain Identified 🚨 Domain: sodiumlaurethsulfatedesyroyer[.]com 🛑 Flagged by 13/96 security vendors as malicious. 💻 What is Lokibot? A sophisticated banking trojan targeting Windows: Steals login credentials, financial info & sensitive data.…
0
1
1
0
253
banthisguy9349's profile picture. Just a person who is against cyber crime and dictators like Putin
Fox_threatintel
 @banthisguy9349
Dec 6

#lokibot #c2 hxxp://ghcopz.shop/BISH/PWS/PvqDq929BSx_A_D_M1n_a.php malware coming from the previous c2: dddotx[.]shop cc: @ViriBack

banthisguy9349's tweet image. #lokibot #c2 hxxp://ghcopz.shop/BISH/PWS/PvqDq929BSx_A_D_M1n_a.php malware coming from the previous c2: dddotx[.]shop cc: @ViriBack
1
0
4
3
739
Unit42_Intel's profile picture. The latest research and news from Unit 42, the Palo Alto Networks (@paloaltontwks) Threat Intelligence and Security Consulting Team covering incident response.
Unit 42
 @Unit42_Intel
Mar 8, 2023

From a suspicious spike to a malicious ISO file, we track a #LokiBot infection. Our evaluation includes coverage of the tools we used and the data that resulted from this email campaign. bit.ly/3Yi2uec

Unit42_Intel's tweet image. From a suspicious spike to a malicious ISO file, we track a #LokiBot infection. Our evaluation includes coverage of the tools we used and the data that resulted from this email campaign. bit.ly/3Yi2uec
0
9
22
3
4K
banthisguy9349's profile picture. Just a person who is against cyber crime and dictators like Putin
Fox_threatintel
 @banthisguy9349
Dec 18, 2023

#lokibot #malware targetting german citizens with the following domains: kwk-identificatie[.]ir, deutsche-registrierung[.]ir, deutsche-aktivierung[.]ir other domains: sempersim[.]su, cfgd[.]in, bfdlcloud[.]lol c2's :103.215.221.168 | 104.237.252.65 @Gi7w0rm @DeutscheBank

banthisguy9349's tweet image. #lokibot #malware targetting german citizens with the following domains: kwk-identificatie[.]ir, deutsche-registrierung[.]ir, deutsche-aktivierung[.]ir other domains: sempersim[.]su, cfgd[.]in, bfdlcloud[.]lol c2's :103.215.221.168 | 104.237.252.65 @Gi7w0rm @DeutscheBank
4
4
12
2
9K
unit42_jp's profile picture. パロアルトネットワークス(@PaloAltoNtwksJP) のスレットインテリジェンス & セキュリティコンサルティングチーム Unit 42 から最新のリサーチレポートとニュースをお伝えします。
Unit 42 Japan
 @unit42_jp
Mar 6, 2023

2022年の最終週にインフォスティーラー(情報窃取型マルウェア)の #LokiBot のアクティビティ急増が確認されました。この事例からサンプルを解析し、窃取対象となるアプリケーションや窃取されるデータの種類、同マルウェアの主な機能を含むIoCを共有します。 bit.ly/3SO3DJv

unit42_jp's tweet image. 2022年の最終週にインフォスティーラー(情報窃取型マルウェア)の #LokiBot のアクティビティ急増が確認されました。この事例からサンプルを解析し、窃取対象となるアプリケーションや窃取されるデータの種類、同マルウェアの主な機能を含むIoCを共有します。 bit.ly/3SO3DJv
0
3
4
1
598
threatquery's profile picture. Trust in ThreatQuery fear no threats.
ThreatQuery
 @threatquery
Oct 24

🚨 New C2 Detected! 🔗 18[.]239[.]83[.]83 ℹ️ ASN: AS16509 ℹ️ ASN Organization: Amazon.com, Inc. 📍 Country: NL 📍 City: Amsterdam 📅 2025-10-24T17:48:23 ℹ️ Type: #cnc - #c2 ℹ️ Family: #LokiBot #ThreatIntelligence #IoCs #Malware

0
0
0
0
368
threatquery's profile picture. Trust in ThreatQuery fear no threats.
ThreatQuery
 @threatquery
Oct 24

🚨 New C2 Detected! 🔗 18[.]66[.]147[.]8 ℹ️ ASN: AS16509 ℹ️ ASN Organization: Amazon.com, Inc. 📍 Country: DE 📍 City: Mörfelden-Walldorf 📅 2025-10-24T18:08:27 ℹ️ Type: #cnc - #c2 ℹ️ Family: #LokiBot #ThreatIntelligence #IoCs #Malware

0
0
0
0
362
threatquery's profile picture. Trust in ThreatQuery fear no threats.
ThreatQuery
 @threatquery
Oct 23

🚨 New C2 Detected! 🔗 3[.]170[.]19[.]103 ℹ️ ASN: AS16509 ℹ️ ASN Organization: Amazon.com, Inc. 📍 Country: US 📍 City: South Riding 📅 2025-10-23T17:36:14 ℹ️ Type: #cnc - #c2 ℹ️ Family: #LokiBot #ThreatIntelligence #IoCs #Malware

0
0
0
0
436
SarlackLab's profile picture. THIS ACCOUNT IS A #BOT 🤖 (mostly) Autonomous #malware sandbox && #C2 cartographer Developed by @Abjuri5t and assistants https://t.co/KrV5T8lDY2
SarlackLab
 @SarlackLab
Oct 23

#lokibot #C2 server 172.67.142[.]33:80 confirmed 2025-10-23

0
0
0
1
262
SarlackLab's profile picture. THIS ACCOUNT IS A #BOT 🤖 (mostly) Autonomous #malware sandbox && #C2 cartographer Developed by @Abjuri5t and assistants https://t.co/KrV5T8lDY2
SarlackLab
 @SarlackLab
Oct 23

#lokibot #C2 server 104.21.39[.]18:80 sellea-ims[.]cfd confirmed 2025-10-23

0
0
1
0
238
threatquery's profile picture. Trust in ThreatQuery fear no threats.
ThreatQuery
 @threatquery
Oct 22

🚨 New C2 Detected! 🔗 54[.]208[.]125[.]145 ℹ️ ASN: AS14618 ℹ️ ASN Organization: Amazon.com, Inc. 📍 Country: US 📍 City: Ashburn 📅 2025-10-22T17:09:39 ℹ️ Type: #cnc - #c2 ℹ️ Family: #LokiBot #ThreatIntelligence #IoCs #Malware

0
0
0
0
384
threatquery's profile picture. Trust in ThreatQuery fear no threats.
ThreatQuery
 @threatquery
Oct 20

🚨 New C2 Detected! 🔗 37[.]9[.]111[.]142 ℹ️ ASN: AS13238 ℹ️ ASN Organization: YANDEX LLC 📍 Country: RU 📍 City: Moscow 📅 2025-10-20T18:43:40 ℹ️ Type: #cnc - #c2 ℹ️ Family: #LokiBot #ThreatIntelligence #IoCs #Malware

0
0
0
0
392
threatquery's profile picture. Trust in ThreatQuery fear no threats.
ThreatQuery
 @threatquery
Oct 19

🚨 New C2 Detected! 🔗 61[.]160[.]192[.]98 ℹ️ ASN: AS140293 ℹ️ ASN Organization: CHINATELECOM Jiangsu province Changzhou 5G network 📍 Country: CN 📍 City: Nanjing 📅 2025-10-19T16:15:07 ℹ️ Type: #cnc - #c2 ℹ️ Family: #LokiBot #ThreatIntelligence #IoCs #Malware

0
0
0
0
511
threatquery's profile picture. Trust in ThreatQuery fear no threats.
ThreatQuery
 @threatquery
Oct 19

🚨 New C2 Detected! 🔗 18[.]159[.]18[.]235 ℹ️ ASN: AS16509 ℹ️ ASN Organization: Amazon.com, Inc. 📍 Country: DE 📍 City: Frankfurt am Main 📅 2025-10-19T17:54:22 ℹ️ Type: #cnc - #c2 ℹ️ Family: #LokiBot #ThreatIntelligence #IoCs #Malware

0
0
0
0
414
QintegraC's profile picture. Especialistas en #ciberseguridad y #ciberinteligencia.
Qintegra Consulting
 @QintegraC
Oct 18

🟠#LokiBot se desarrolló en 2015 para robar información de diversas aplicaciones. A pesar de su antigüedad, este malware sigue siendo bastante popular entre los ciberdelincuentes. #QintegraNews #ciberseguridad @Medium medium.com/@anyrun/lokibo…

QintegraC's tweet card. LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular…
LokiBot: Malware Overview
Source: medium.com
1
0
1
0
48
threatquery's profile picture. Trust in ThreatQuery fear no threats.
ThreatQuery
 @threatquery
Oct 17

🚨 New C2 Detected! 🔗 18[.]66[.]112[.]94 ℹ️ ASN: AS16509 ℹ️ ASN Organization: Amazon.com, Inc. 📍 Country: DE 📍 City: Mörfelden-Walldorf 📅 2025-10-17T17:31:58 ℹ️ Type: #cnc - #c2 ℹ️ Family: #LokiBot #ThreatIntelligence #IoCs #Malware

0
0
0
0
374
threatquery's profile picture. Trust in ThreatQuery fear no threats.
ThreatQuery
 @threatquery
Oct 17

🚨 New C2 Detected! 🔗 185[.]111[.]111[.]155 ℹ️ ASN: AS212238 ℹ️ ASN Organization: Datacamp Limited 📍 Country: DE 📍 City: Frankfurt am Main 📅 2025-10-17T17:44:52 ℹ️ Type: #cnc - #c2 ℹ️ Family: #LokiBot #ThreatIntelligence #IoCs #Malware

0
0
0
0
347
threatquery's profile picture. Trust in ThreatQuery fear no threats.
ThreatQuery
 @threatquery
Oct 15

🚨 New C2 Detected! 🔗 31[.]31[.]197[.]13 ℹ️ ASN: AS197695 ℹ️ ASN Organization: "Domain names registrar REG.RU", Ltd 📍 Country: RU 📍 City: Moscow 📅 2025-10-15T18:10:18 ℹ️ Type: #cnc - #c2 ℹ️ Family: #LokiBot #ThreatIntelligence #IoCs #Malware

0
0
0
0
281
cyberfeeddigest's profile picture. I deliver daily #DarkWeb ,#DeepWeb and #CTI feeds,and a bit of geopolitical clashes #Darkweb #Deepweb #Ransomware #Malware #Databreach #CTI #ThreatIntel
darkweb-deepwebfeed
 @cyberfeeddigest
Oct 14

🛑 'Loki Bot' Listing — CVV Shop Sells Android Loki Bot A CVV marketplace is advertising an advanced Android stealer (card grabber, SMS/USSD intercept, screen locker, contacts & app harvesting, and...). Handle with extreme caution — for #Malware analysts #LokiBot #CyberCrime

cyberfeeddigest's tweet image. 🛑 'Loki Bot' Listing — CVV Shop Sells Android Loki Bot A CVV marketplace is advertising an advanced Android stealer (card grabber, SMS/USSD intercept, screen locker, contacts & app harvesting, and...). Handle with extreme caution — for #Malware analysts #LokiBot #CyberCrime
0
4
18
5
2K
threatquery's profile picture. Trust in ThreatQuery fear no threats.
ThreatQuery
 @threatquery
Oct 5

🚨 New C2 Detected! 🔗 92[.]113[.]16[.]213 ℹ️ ASN: AS47583 ℹ️ ASN Organization: Hostinger International Limited 📍 Country: DE 📍 City: Frankfurt am Main 📅 2025-10-05T17:40:10 ℹ️ Type: #cnc - #c2 ℹ️ Family: #LokiBot #ThreatIntelligence #IoCs #Malware

0
0
0
0
414
SarlackLab's profile picture. THIS ACCOUNT IS A #BOT 🤖 (mostly) Autonomous #malware sandbox && #C2 cartographer Developed by @Abjuri5t and assistants https://t.co/KrV5T8lDY2
SarlackLab
 @SarlackLab
Oct 2

#lokibot #C2 server 172.67.147[.]216:80 confirmed 2025-10-02

0
0
0
1
183
SarlackLab's profile picture. THIS ACCOUNT IS A #BOT 🤖 (mostly) Autonomous #malware sandbox && #C2 cartographer Developed by @Abjuri5t and assistants https://t.co/KrV5T8lDY2
SarlackLab
 @SarlackLab
Oct 2

#lokibot #C2 server 104.21.63[.]165:80 montblancgroup[.]cfd confirmed 2025-10-02

0
0
0
0
193
SarlackLab's profile picture. THIS ACCOUNT IS A #BOT 🤖 (mostly) Autonomous #malware sandbox && #C2 cartographer Developed by @Abjuri5t and assistants https://t.co/KrV5T8lDY2
SarlackLab
 @SarlackLab
Oct 1

#lokibot #C2 server 52.43.119[.]120:80 securebrainwork[.]site confirmed 2025-10-01

0
0
2
2
271
SarlackLab's profile picture. THIS ACCOUNT IS A #BOT 🤖 (mostly) Autonomous #malware sandbox && #C2 cartographer Developed by @Abjuri5t and assistants https://t.co/KrV5T8lDY2
SarlackLab
 @SarlackLab
Oct 1

#lokibot #C2 server 94.154.35[.]238:80 confirmed 2025-10-01

0
0
0
0
122
threatquery's profile picture. Trust in ThreatQuery fear no threats.
ThreatQuery
 @threatquery
Sep 30

🚨 New C2 Detected! 🔗 35[.]238[.]5[.]172 ℹ️ ASN: AS396982 ℹ️ ASN Organization: Google LLC 📍 Country: US 📍 City: Council Bluffs 📅 2025-09-30T17:33:00 ℹ️ Type: #cnc - #c2 ℹ️ Family: #LokiBot #ThreatIntelligence #IoCs #Malware

0
0
0
0
344
cyberfeeddigest's profile picture. I deliver daily #DarkWeb ,#DeepWeb and #CTI feeds,and a bit of geopolitical clashes #Darkweb #Deepweb #Ransomware #Malware #Databreach #CTI #ThreatIntel
darkweb-deepwebfeed
 @cyberfeeddigest
Oct 14

🛑 'Loki Bot' Listing — CVV Shop Sells Android Loki Bot A CVV marketplace is advertising an advanced Android stealer (card grabber, SMS/USSD intercept, screen locker, contacts & app harvesting, and...). Handle with extreme caution — for #Malware analysts #LokiBot #CyberCrime

cyberfeeddigest's tweet image. 🛑 'Loki Bot' Listing — CVV Shop Sells Android Loki Bot A CVV marketplace is advertising an advanced Android stealer (card grabber, SMS/USSD intercept, screen locker, contacts & app harvesting, and...). Handle with extreme caution — for #Malware analysts #LokiBot #CyberCrime
0
4
18
5
2K
kienbigmummy's profile picture. Work hard in silence , let success make the noise.
m4n0w4r
 @kienbigmummy
Feb 21, 2023

🔥An email related to VN spreads #LokiBot ✉️hash:88b508f0e10b580ca93c71938b3b6eb97b39a3f3b5cc50b6e8ce855d4bdd3709 IOCs: ☠️103[.]140.251.225 🌐http://eyecos[.]ga/kung/gate.php

kienbigmummy's tweet image. 🔥An email related to VN spreads #LokiBot ✉️hash:88b508f0e10b580ca93c71938b3b6eb97b39a3f3b5cc50b6e8ce855d4bdd3709 IOCs: ☠️103[.]140.251.225 🌐http://eyecos[.]ga/kung/gate.php
1
19
41
5
7K
Gi7w0rm's profile picture. Threat Intelligence Analyst | See my Linktree for other socials | In case I post false intel, contact me! Support me: https://t.co/5WgDqr0K8p 🇪🇺🇩🇪🇺🇦🌈
Gi7w0rm
 @Gi7w0rm
Oct 12, 2023

What a beautiful way to start the day :) #Lokibot #panel #itw

Gi7w0rm's tweet image. What a beautiful way to start the day :) #Lokibot #panel #itw
2
3
53
8
8K
Jane_0sint's profile picture. Network traffic numismatist 🔎
Jane
@Jane_0sint
Aug 14, 2023

A simple and rarely seen example of extracting data stolen by a #lokibot, not that it's a big deal, but it might come in handy for someone💁‍♀️

Jane_0sint's tweet image. A simple and rarely seen example of extracting data stolen by a #lokibot, not that it's a big deal, but it might come in handy for someone💁‍♀️
Jane_0sint's tweet image. A simple and rarely seen example of extracting data stolen by a #lokibot, not that it's a big deal, but it might come in handy for someone💁‍♀️
anyrun_app's profile picture. Empowering businesses with proactive security solutions: Interactive Sandbox, TI Lookup and Feeds. Sign up: https://t.co/8hIX0Qh5ME
ANY.RUN
@anyrun_app
Aug 14, 2023

#LokiBot is one of the most enduring credential stealers. On ANYRUN, the first tag for LokiBot was applied on March 6, 2018, making it one of the first public submissions. 🟥 - The aPLib compression algorithm is used to compress the decoded exfiltrated data and credentials from…

anyrun_app's tweet image. #LokiBot is one of the most enduring credential stealers. On ANYRUN, the first tag for LokiBot was applied on March 6, 2018, making it one of the first public submissions. 🟥 - The aPLib compression algorithm is used to compress the decoded exfiltrated data and credentials from…
anyrun_app's tweet image. #LokiBot is one of the most enduring credential stealers. On ANYRUN, the first tag for LokiBot was applied on March 6, 2018, making it one of the first public submissions. 🟥 - The aPLib compression algorithm is used to compress the decoded exfiltrated data and credentials from…
0
10
21
0
9K
0
13
31
1
4K
v0lundr_'s profile picture. Clicking on traffic lights, buses and fire hydrants in my spare time!
v0lundr
 @v0lundr_
Nov 28, 2023

#opendir on 146.70.35[.]211 delivering #lokibot

v0lundr_'s tweet image. #opendir on 146.70.35[.]211 delivering #lokibot
0
0
1
0
185
ptswarm's profile picture. Positive Technologies Offensive Team
PT SWARM
 @ptswarm
Dec 19

🇻🇳 From Positive Hack Talks in Hanoi: @kienbigmummy on using IDA AppCall to deobfuscate malware! Learn how to: 1⃣ Recover hidden WinAPI names (e.g., #LokiBot) 2⃣ Extract strings & C&C addresses (e.g., #Emotet) Applicable to your samples! The slides 👉 static.ptsecurity.com/events/empower…

ptswarm's tweet image. 🇻🇳 From Positive Hack Talks in Hanoi: @kienbigmummy on using IDA AppCall to deobfuscate malware! Learn how to: 1⃣ Recover hidden WinAPI names (e.g., #LokiBot) 2⃣ Extract strings & C&C addresses (e.g., #Emotet) Applicable to your samples! The slides 👉 static.ptsecurity.com/events/empower…
0
8
28
8
5K
ShanHolo's profile picture. Another blue team member…..#CSIRT #DFIR #Malware #4n6 #ThreatIntel and following the white rabbit...
Shanholo
 @ShanHolo
Jul 23, 2024

🚨#Opendir #Malware 🚨 🧵1/2 hxxp://198.46.178.229/55433/ ⚠️#Lokibot #Stealer winiti.exe➡️MD5:33f3dc03864d8d5cce813683d49ad2dd 📡5 C2: hxxp://overclockingmachines.info/bally/fre.php hxxp://kbfvzoboss.bid/alien/fre.php hxxp://alphastand.trade/alien/fre.php

ShanHolo's tweet image. 🚨#Opendir #Malware 🚨 🧵1/2 hxxp://198.46.178.229/55433/ ⚠️#Lokibot #Stealer winiti.exe➡️MD5:33f3dc03864d8d5cce813683d49ad2dd 📡5 C2: hxxp://overclockingmachines.info/bally/fre.php hxxp://kbfvzoboss.bid/alien/fre.php hxxp://alphastand.trade/alien/fre.php
1
1
5
1
403
kienbigmummy's profile picture. Work hard in silence , let success make the noise.
m4n0w4r
 @kienbigmummy
Feb 7, 2023

🔥 An email spreads #LokiBot ✉️hash: 55f21edd4d3d287b961b57d6215a809cc06fe00c8f649ed812522b8061276409 IOCs: 📄http://192[.]3.223.114/77.doc 👹http://192[.]3.223.114/477/vbc.exe 🌐http://sempersim[.]su/ha1/fre.php

kienbigmummy's tweet image. 🔥 An email spreads #LokiBot ✉️hash: 55f21edd4d3d287b961b57d6215a809cc06fe00c8f649ed812522b8061276409 IOCs: 📄http://192[.]3.223.114/77.doc 👹http://192[.]3.223.114/477/vbc.exe 🌐http://sempersim[.]su/ha1/fre.php
2
18
44
4
6K
v0lundr_'s profile picture. Clicking on traffic lights, buses and fire hydrants in my spare time!
v0lundr
 @v0lundr_
Dec 1, 2023

#opendir on 23.227.196.204 spreading #Lokibot and reaching out to good old sempersim[.]su

v0lundr_'s tweet image. #opendir on 23.227.196.204 spreading #Lokibot and reaching out to good old sempersim[.]su
1
0
1
0
469
cyberfeeddigest's profile picture. I deliver daily #DarkWeb ,#DeepWeb and #CTI feeds,and a bit of geopolitical clashes #Darkweb #Deepweb #Ransomware #Malware #Databreach #CTI #ThreatIntel
darkweb-deepwebfeed
 @cyberfeeddigest
Sep 24, 2024

#C2, #Malware #Lokibot hxxp://werdotx[.]shop/Devil/PWS/PvqDq929BSx_A_D_M1n_a.php hxxps://trvtest[.]click/RF/PWS/PvqDq929BSx_A_D_M1n_a.php cc:@500mk500, @HuntIO, @ViriBack, @drb_ra, @hasherezade,@ReversingLabs, @JAMESWT_MHT,@Arkbird_SOLG,@0xor0ne,@ESETresearch,@0x6rss ,…

cyberfeeddigest's tweet image. #C2, #Malware #Lokibot hxxp://werdotx[.]shop/Devil/PWS/PvqDq929BSx_A_D_M1n_a.php hxxps://trvtest[.]click/RF/PWS/PvqDq929BSx_A_D_M1n_a.php cc:@500mk500, @HuntIO, @ViriBack, @drb_ra, @hasherezade,@ReversingLabs, @JAMESWT_MHT,@Arkbird_SOLG,@0xor0ne,@ESETresearch,@0x6rss ,…
0
0
2
0
348
cyberfeeddigest's profile picture. I deliver daily #DarkWeb ,#DeepWeb and #CTI feeds,and a bit of geopolitical clashes #Darkweb #Deepweb #Ransomware #Malware #Databreach #CTI #ThreatIntel
darkweb-deepwebfeed
 @cyberfeeddigest
Sep 12, 2024

C2 panel of #Lokibot #Stealer #Malware detected: hxxps://touxzw[.]ir/sweetwhore/five/PvqDq929BSx_A_D_M1n_a.php cc:@abuse_ch #cybersecurity #malware #Lockibot #Stealer

cyberfeeddigest's tweet image. C2 panel of #Lokibot #Stealer #Malware detected: hxxps://touxzw[.]ir/sweetwhore/five/PvqDq929BSx_A_D_M1n_a.php cc:@abuse_ch #cybersecurity #malware #Lockibot #Stealer
0
0
0
0
189
ShanHolo's profile picture. Another blue team member…..#CSIRT #DFIR #Malware #4n6 #ThreatIntel and following the white rabbit...
Shanholo
 @ShanHolo
Dec 1

🚨#Opendir #Malware🚨 hxxp://66.63.187.231/35/ ⚠️#Lokibot ☣️TU-35.exe ➡️4dea06ea49de777e6458e274d7bd5dae 📡http://94.156.177.41/maxzi/five/fre.php 📡hxxp://kbfvzoboss.bid/alien/fre.php 📡hxxp://alphastand.trade/alien/fre.php 📡hxxp://alphastand.win/alien/fre.php

ShanHolo's tweet image. 🚨#Opendir #Malware🚨 hxxp://66.63.187.231/35/ ⚠️#Lokibot ☣️TU-35.exe ➡️4dea06ea49de777e6458e274d7bd5dae 📡http://94.156.177.41/maxzi/five/fre.php 📡hxxp://kbfvzoboss.bid/alien/fre.php 📡hxxp://alphastand.trade/alien/fre.php 📡hxxp://alphastand.win/alien/fre.php
1
1
8
2
749
kienbigmummy's profile picture. Work hard in silence , let success make the noise.
m4n0w4r
 @kienbigmummy
Jun 6, 2023

🔥 An email sample spreads #LokiBot was submitted from VN! ✉️27011215dce27a21aaa6a08898f11672 🐛93ed842119d52c8104eba8c1d3cbfe8e IOCs: 🌐http://161[.]35.102.56/~nikol/?p=314875839320

kienbigmummy's tweet image. 🔥 An email sample spreads #LokiBot was submitted from VN! ✉️27011215dce27a21aaa6a08898f11672 🐛93ed842119d52c8104eba8c1d3cbfe8e IOCs: 🌐http://161[.]35.102.56/~nikol/?p=314875839320
kienbigmummy's tweet image. 🔥 An email sample spreads #LokiBot was submitted from VN! ✉️27011215dce27a21aaa6a08898f11672 🐛93ed842119d52c8104eba8c1d3cbfe8e IOCs: 🌐http://161[.]35.102.56/~nikol/?p=314875839320
0
8
32
5
3K
proofpoint's profile picture. Protect people. Defend data. Mitigate human risk. Follow @threatinsight for updates on the threat landscape.
Proofpoint
@proofpoint
Dec 1, 2023

Threat actor TA2540 continued its high-volume email activity in November, with campaign message volumes as high as six figures in some cases. While the group has recently favored #AgentTesla, multiple campaigns featured #LokiBot #malware. @ThreatInsight 💡

proofpoint's tweet image. Threat actor TA2540 continued its high-volume email activity in November, with campaign message volumes as high as six figures in some cases. While the group has recently favored #AgentTesla, multiple campaigns featured #LokiBot #malware. @ThreatInsight 💡
0
2
1
0
422
kienbigmummy's profile picture. Work hard in silence , let success make the noise.
m4n0w4r
 @kienbigmummy
Mar 4, 2023

🔥An email sample related to VN spreads #Lokibot ✉️hash:cb87ec5825659ec1919ac6ffdec4b88e4336c0be420c726ceab1917689fdd161 IOCs: ☠️107[.]175.212.18 🌐http://185[.]246.220.60/shen/five/fre.php

kienbigmummy's tweet image. 🔥An email sample related to VN spreads #Lokibot ✉️hash:cb87ec5825659ec1919ac6ffdec4b88e4336c0be420c726ceab1917689fdd161 IOCs: ☠️107[.]175.212.18 🌐http://185[.]246.220.60/shen/five/fre.php
kienbigmummy's tweet image. 🔥An email sample related to VN spreads #Lokibot ✉️hash:cb87ec5825659ec1919ac6ffdec4b88e4336c0be420c726ceab1917689fdd161 IOCs: ☠️107[.]175.212.18 🌐http://185[.]246.220.60/shen/five/fre.php
0
11
27
4
5K
kienbigmummy's profile picture. Work hard in silence , let success make the noise.
m4n0w4r
 @kienbigmummy
Feb 15, 2023

🔥An email spreads #LokiBot was submitted to VT from VN! ✉️hash: 5df9df2e1b4aeec1b8036c627dcaeffb049853d2f1c6bcf83109e541c36a46ac IOCs: 🐛http://195[.]133.40.108/explorer/.win32.exe 🌐http://sempersim[.]su/ha19/fre.php

kienbigmummy's tweet image. 🔥An email spreads #LokiBot was submitted to VT from VN! ✉️hash: 5df9df2e1b4aeec1b8036c627dcaeffb049853d2f1c6bcf83109e541c36a46ac IOCs: 🐛http://195[.]133.40.108/explorer/.win32.exe 🌐http://sempersim[.]su/ha19/fre.php
1
12
31
1
4K
banthisguy9349's profile picture. Just a person who is against cyber crime and dictators like Putin
Fox_threatintel
 @banthisguy9349
Dec 6

#lokibot #c2 hxxp://ghcopz.shop/BISH/PWS/PvqDq929BSx_A_D_M1n_a.php malware coming from the previous c2: dddotx[.]shop cc: @ViriBack

banthisguy9349's tweet image. #lokibot #c2 hxxp://ghcopz.shop/BISH/PWS/PvqDq929BSx_A_D_M1n_a.php malware coming from the previous c2: dddotx[.]shop cc: @ViriBack
1
0
4
3
739
58_158_177_102's profile picture. 企業のCSIRTの人兼企業のCTOの人。シンクホールは趣味。書き込む内容は所属に関係しているものもありますが、意見や見解は個人的なもの。意識低い低い系/User side Cyber Security Researcher & sinkholer
moto_sato
@58_158_177_102
Apr 3, 2024

日本語マルウェアメールの接到を確認しています。 #malspam in Japanese #guloader #Lokibot 件名 : RV: 価格のリクエスト // TODAI OC 26357 File name : TODAI OC 26357.7z MD5 : 92b88a1994ff2642ef9f74d419843b6e Payload ffrom :…

58_158_177_102's tweet image. 日本語マルウェアメールの接到を確認しています。 #malspam in Japanese #guloader #Lokibot 件名 : RV: 価格のリクエスト // TODAI OC 26357 File name : TODAI OC 26357.7z MD5 : 92b88a1994ff2642ef9f74d419843b6e Payload ffrom :…
1
13
25
7
10K
FalconFeedsio's profile picture. Threat intelligence platform - Data from Deep Web, Dark Web, Open Web || For data API integration : support@falconfeeds.io Democratizing Cyber Security.
FalconFeeds.io
@FalconFeedsio
Apr 28, 2023

LokiBot, is an information stealer malware that harvests credentials from the most popular web browsers, FTP, email clients, and over a hundred applications installed on the infected machine. #LokiBot #stealer #malware #cybersecurity

FalconFeedsio's tweet image. LokiBot, is an information stealer malware that harvests credentials from the most popular web browsers, FTP, email clients, and over a hundred applications installed on the infected machine. #LokiBot #stealer #malware #cybersecurity
FalconFeedsio's tweet image. LokiBot, is an information stealer malware that harvests credentials from the most popular web browsers, FTP, email clients, and over a hundred applications installed on the infected machine. #LokiBot #stealer #malware #cybersecurity
0
2
3
2
3K

Something went wrong.


Something went wrong.


United States Trends