Extracted

• • Target
    ae9148f46dd287d9e9722a31813aab72.exe
  • Size 150KB
  • SHA256 12fbae486c3533a58dec8921ecdf9343158e04a2cf71c04f2c91c0e181743446
  • MD5 ae9148f46dd287d9e9722a31813aab72
  • SHA1 bd6a300b9fe49d81d3e7c6432d8c33b79361f5d0
  • SHA512 23d3db316d123ed73faee18229582b64ddf72d3cab2440bbcb57f24ad828f5fad6d4fa1b3f56493fbb6b60f74188a0b4a25fdca37c328635bd01504cd485e575
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2