Extracted

• • Target
    SUN221101.xlsx
  • Size 186KB
  • SHA256 97837fec29a2ac0cdf10600d976e39fb312f65c6ca9193811d1d2f28d53fa322
  • MD5 6f233cd70aa6de0c93c5421c6b2618a5
  • SHA1 6f716e65c2f3260fded4e92710644078973e6d5f
  • SHA512 04e67f04afd3f168d4634780d4790303b31e0e030b260cb541109c4faf8cbc5ad43c6cdadb2a085261915f65b5ee6afb2c30496bab3e961acd5aa58adb683b4f
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • suricata: ET MALWARE MSIL/GenKryptik.FQRH Download Request

    suricata: ET MALWARE MSIL/GenKryptik.FQRH Download Request

    suricata

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1