Extracted

• • Target
    c64f813073e0f774fd5765c25a3e0d3c
  • Size 149KB
  • SHA256 7b1da3704d0228cebf239b9c8935d500fef9b193c2ca2ba9e89cfd0724acd41c
  • MD5 c64f813073e0f774fd5765c25a3e0d3c
  • SHA1 e27a19d1cf59907ba20ef6b28d523d25ee11a11c
  • SHA512 d45e4e38293bd033796c8a90b3123fbe7d37adc038bb59089c643f58013a66689acf6faaa0eabfdf296db497de08f5407d6d0fc1a2533d2b7cc99a634f153a25
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2