Extracted

• • Target

    6b970780dc37530aaeed3d0e7b4b89d4c5ea6cff662cff96c854af48c3358409.exe

  • Size

    412KB

  • MD5

    2b1b6ebad456e355b0bf36bc7c479e47

  • SHA1

    16cb78a43f5b2372561807ca3a8fe3164499455e

  • SHA256

    6b970780dc37530aaeed3d0e7b4b89d4c5ea6cff662cff96c854af48c3358409

  • SHA512

    d9550ecda607bda498f0924ad90ed0c943948d8ab2aaaecba2f8167b4096e73d379c096dca2425d65252ab6b59a6dda0ed931d3120f0207fd0274c2fde89c26a

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2