Extracted

• • Target
    2ee042fe81d0760c89c80fbb19ddd1fa.exe
  • Size 269KB
  • SHA256 6fcd9b779accb07c3b05ac111df68e64fbc255f81887a60d810b94acd6f44388
  • MD5 2ee042fe81d0760c89c80fbb19ddd1fa
  • SHA1 125ac2f854404fdb3133e128d484bc3bffe95dc4
  • SHA512 458b362da0116bf37713ddb6a792c9d350e137485bf051e3b69461ec19f37a9b877417c5d8705b433fa1394190f4b2e7fb7ac48e36ff6381fbcf6173e8c651af
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotneshtacollectionpersistencespywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2