Extracted

• • Target
    IRQ2107799_pdf.exe
  • Size 417KB
  • SHA256 78680346bd7cc7206f96c624c19cfe2adff4d06bfa651016a4f0a744f808a260
  • MD5 a8c7116c0232534270ca4eea2451ed5e
  • SHA1 50b207c8c0b946dcc51c321d5abb29cec1d56d29
  • SHA512 03da3c5b55c973474e9224b5a9be8e05650371bc1fcbf0d00b9958ff57fcf0d0ad7ca41869b3db6bac9d4753b5f7ec5fa129df7c919b78766789d868b7438b75
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2