Extracted

• • Target
    SecuriteInfo.com.Trojan.MulDrop.1161.895.14575
  • Size 504KB
  • SHA256 6a223f3097e572a00aa6f1029bbbb6d71d66bb5bbf239177d232dca3c7f9bf33
  • MD5 32ffae9524a6321051248e4313c91852
  • SHA1 5e28c29f740842a5eee6f2717d25f86dd3b0f752
  • SHA512 60bb5521d91b14e510d10df9a21619c81724b81cf5d999f7719ca433f7d34da81b06f9cb982a4bec42e78d92b892c8181adc326669b2a0446e6adf1114468cc7
  • MD5 SHA1 SHA512

  Score

  10^/10

  trojanspywarestealerlokibotpersistence

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  behavioral1behavioral2