Extracted

• • Target
    a92583de8cc0387bf6631b2a6790fd01.exe
  • Size 230KB
  • SHA256 df749f2d718e78d00b5dbffb57a386ff33f5909c032f52c7cfaf6ca135034b4c
  • MD5 a92583de8cc0387bf6631b2a6790fd01
  • SHA1 eec4306840e05a4d337da1dcafdb0ca3903be2a0
  • SHA512 395e6e764348a34e34a27c7723ea8210483d51e24990139fefabd75c4e65384436ed16023244962dad494b6101122683b887fe735630573ecf82a739a337f73e
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2