Extracted

• • Target
    DHL Shipping Documents.exe
  • Size 502KB
  • SHA256 c77a86c2fd4917b172c2713bc886d1c19d1aedf1473e4076b3dca19504ac2e9b
  • MD5 1b6714c2afc1a7bda84431078fa6800b
  • SHA1 78f23b72842d3e917cf9373051cd9ecafcb35a51
  • SHA512 76eca8f98c64bd219a1acfc9f54ada80c3e3acca718e5ddf17721e87a136f47c469be6f7ea0d5df06248ca046b042675ee8e96855b6eb8c985294ba3c93ad6d1
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2