Extracted

• • Target
    RFQ7943977.exe
  • Size 292KB
  • SHA256 b462931f447af5c2d7cc5b4b5505e4ee5bbdc2e0b576687292c9c842e30a7473
  • MD5 c69ea2502eec5ebf7e0a75cf56114874
  • SHA1 5b62b9c0d323b38419be68915db13468fde999d8
  • SHA512 d1de71a4d5ed0296aff6aa522c7c4ec532b26ff60bc290319948dc461a4dc79994f7d71acd8d9d8fe395bb9f3663b927c81afe78e9d9d8bece0ccff5debf7534
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2