Extracted

• • Target
    TMB 20321 SWIFT REQUISITION.exe
  • Size 352KB
  • SHA256 641b9313db551a0e335a6e32db6d94aa57cc2913703ed3df7fcdf66cb4142b43
  • MD5 d9d23947e29e8d4504f6afaa3d8d8609
  • SHA1 d49e4f5526358558e6fd7c526f7c57d5ffbf09a4
  • SHA512 8e660ca2fe6f0781aa08e7f55245ad2960c6f6a0f759820bcb83e9de3c0877cedf7975934dac85d38989b8653d67d7c42bcc7a493e325291193fd5c7ce7f1aeb
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2