Extracted

• • Target
    0ebf139feb9dd170366c73d1d7a6c3b9.exe
  • Size 123KB
  • SHA256 2559470d892d939b0df177b1613313cc1b2bced2a17cda536de05d0c02e09d20
  • MD5 0ebf139feb9dd170366c73d1d7a6c3b9
  • SHA1 c68443e242e7ff84b5711c531eada1d073c8c9a3
  • SHA512 f26ed8402f0cc5c9ebcf806ac652198882641a4a7dc95c2429b1ebb4debe0869f347c3496792bd070712e4b1a68f7d1836a9e3fb22e3386d561289aa40ece34d
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot Fake 404 Response

    suricata: ET MALWARE LokiBot Fake 404 Response

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2