Extracted

• • Target
    DHL Express Shipping Document.exe
  • Size 712KB
  • SHA256 6a294674cd569b7c5dbb939614aeaf234c38ff3dbbd2d72dc5dcadcd43bc665f
  • MD5 424db41d242f471a4cc3fd27ab1e8db2
  • SHA1 eb80c0d5ea0dab86b2b9625ccb79769a751ff6c3
  • SHA512 e59013ca2f6686f26a8e0a30008bad442dbcc0655a8a9cc99b4bdab7a911d32edea7c4983baeacfbe3403a5cf91f4b844ea9b23d243a854f9a34a54e24ec0d8f
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionevasionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2