Extracted

• • Target
    Remittance Advice.exe
  • Size 465KB
  • SHA256 57de4b89ff8491d2a6e26ff222bf182f9d102a038d63f3e15869fb0d410fcf76
  • MD5 975e60f85b84755794a7434470a71cae
  • SHA1 414cc71425c319d20a6bb4af881b0b0de9c9721c
  • SHA512 eff587ef11562567358736f621b58e1e7ee5e203be74dc10dd3ab8a9a7b56aa4675785139e699c6427f124e9ae9d1d96dd8280a0949e0d3e32ff5d11d74ff93b
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2