Extracted

• • Target
    0e6b9a3c952ce2644452faf0d9c97a0e
  • Size 240KB
  • SHA256 cc3aa875dfa50f91683398005b200c8b64e992553450a9c9d58023e5e6eeb44b
  • MD5 0e6b9a3c952ce2644452faf0d9c97a0e
  • SHA1 ec9b7c9ccf0697812f5a820cb4a39e0c573be38e
  • SHA512 62ead300f7123bd64d6ff136bd1f593e8ac799efe645a2c02a121eaa907a55c7e832f9e8d88ee0a71fc96dadf1ca3185fcfa61df6f579728e4a6fe0b8203bce8
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2