Extracted

• • Target
    Il792d0nDqpen5E.exe
  • Size 720KB
  • SHA256 73995d6f305bc8dc5f718ee1703cceba021b5f80f1acdd526e647dc20ba76d6d
  • MD5 0a4d334016981fff3d77ffb54ceb2fb7
  • SHA1 76569d0f8cdd2dcc0b4066fd513cc49a3a792a20
  • SHA512 076f5beb2b4534709a5ba33a8efac0e931ec5fad621beeebe0562bfe9bc12f8e8a80896f81dd84152084fb6027e14cddc1c89c0b6325282c9cacebd681f9ab22
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionevasionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2