Extracted

• • Target
    Copia de Remesapdf.exe
  • Size 497KB
  • SHA256 ea4e421a809854f53794fe7beb0e77aa813287565edcfc904deadee8121caf3a
  • MD5 41e84ffe29d72367bc21dc833521ecf5
  • SHA1 06c796fbf43f8b89699563b4ae6d36a2af944610
  • SHA512 a7b8fdbaf8971e04c0455b26005e925260070a8d43921db11abee6eefe1946915429c45e7a113ac44a3061043dd4c0b427f522f310148322024dd7028a261cb7
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2