Extracted

• • Target
    მოთხოვნა 04-04-2022.xlsx
  • Size 187KB
  • SHA256 5537b7d160727e6ab50018ab28ceb7c79e15f1dd3e5914cea77be78bac9d8f21
  • MD5 e3ac207f3ed06b0e3a2d4e65469a130a
  • SHA1 1840ed7604a34a123ca3d094766e8854031d5611
  • SHA512 c6d2eb682a5921730736afc52d3e8e6eb82c16ecca4fa08efd57ccfc0129af1753dd918bda3186a2ec55c15e109fedc3179c4edb365475e56128b9cf4abdac45
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • suricata: ET MALWARE MSIL/GenKryptik.FQRH Download Request

    suricata: ET MALWARE MSIL/GenKryptik.FQRH Download Request

    suricata

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2