Extracted

• • Target
    ES2022120412165.PDF.exe
  • Size 305KB
  • SHA256 1392352cd11cf398da07f79608953da2ef2d5e5beae35fd48512402d62b26f4a
  • MD5 84f498d4d4aa5027dcd8393eabea9e0f
  • SHA1 4adcf0102860d14f063380ca78455104f98aca19
  • SHA512 ab88fabedbeb7b3bb6fba933f5520512d96293ec7386126779638df6d06dc9a5ef5c6d46ee6f8677fbfd13fe852f8d5903f4a883a05ff2cb29367d9679b071f6
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2