Extracted

• • Target
    6eb77482ad919e60c33f105bbde54c77.exe
  • Size 279KB
  • SHA256 3b7cd7be09d6a92f29d880b489b3efaea53d7bd2f20bcb02353cc4fa08c6570a
  • MD5 6eb77482ad919e60c33f105bbde54c77
  • SHA1 49d3c59d4a2678a35ad76bff7879f14de2d1e888
  • SHA512 55f5ea06e4dcff96dcb7748b578f77b0b941fa493f073f705207a4920d5ce0fc2715de020eb6211c0ac7e76fed24df008106b3a4a6405c029bea114b5fb1d068
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2