Extracted

• • Target
    66928bd4e1852ed1f85772581e01b886
  • Size 230KB
  • SHA256 e85188612aa3a2ae2cdedcf14fc707bd4730351f4d5e0895b68f6f74c401f92c
  • MD5 66928bd4e1852ed1f85772581e01b886
  • SHA1 7d0506bbce7e6a0cdc0c4155cd8c7b1eb30b0810
  • SHA512 1f39bb861825ebb82216672b5cd47e04b97143632e4ec36eab7a7210bc659b6948f40fc8934857160283069de8a114b59c679a89254b1b6588aa59b60afa75a9
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2