Extracted

• • Target
    PO 290921-021A.exe
  • Size 789KB
  • SHA256 6cc3d22a641945f3f2af9a672421b58fabd9571aabded8d2607d3b3bdd44d989
  • MD5 ddbf9655fa3e197be8eeef1624e20d87
  • SHA1 d1e51507367a0490e9f649b54ea157ccca45e8ab
  • SHA512 3f6c1fe72851c8d8125356a3c93f25a1fc86ceccbd22eb338d24e81d38de56a9bd59adfecb1f9d2e395aeb447b03f35b241126b8128752fd7d93347a40822c94
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2