Extracted

• • Target
    DHL Express Packing List.exe
  • Size 367KB
  • SHA256 e381c16b6ea4e3d809cb3e2099a1b63f8d804a61e3442d9a0b72b71dca2c042a
  • MD5 f9678d9dfd723ef31e2dcb1270ed03ad
  • SHA1 cc93fde596a7b9b9e7074c30121c307153c6d881
  • SHA512 9c7730d1669d83f3b7d6fe6426394873618155bc715a6ac59f43a06820e29678fc3528b5f772b22b420cef02fedb94cd83a1799c3feccd6aecd1eb1933314dca
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionevasionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2