Extracted

• • Target
    PI-AKR-112-2022-02.exe
  • Size 812KB
  • SHA256 83b80a79e69092f45e60809e52e4f1ca1a31351a8013783c8993a9e92a14bb5b
  • MD5 9f8b5ff18215140f1c1a028e85977d01
  • SHA1 4dcd10f2c22f6ed5797cd10d34f053b0a4db13c1
  • SHA512 0c25c6840466b2801404493405863d04fa3005fbdd8d361d9c0ada2f4ff866e82a97dc2c00a3d606bcac2fc81761e96e80607ce04fb9bb986d02d56592bf853e
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealertrojansuricata

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2