Extracted

• • Target
    PO.exe
  • Size 229KB
  • SHA256 d916db2d430e2670b9e6a5995681ddf48c789ce1dcfaa3c0a02c0e8fee2f4123
  • MD5 21bba230879fba436ba0967fecd3c126
  • SHA1 0f3039ffe94b59c4347096d01e228124a99d83ee
  • SHA512 3f71a1f79c8a9d090e3e01e70b92dc574bb8d2a7cf422aa0345920b1dbd89378a727a180e77f039d85a096ad93387b1060af7bac6540ca38ce2b4c9d87376951
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2