Extracted

• • Target
    Zqgmbc.exe
  • Size 353KB
  • SHA256 604cfa1c1f0957f81456dca9dc28be711eacdb2b64ec0023b8dad52e9627ff00
  • MD5 ddb2d596ed4a5df0234476ca0fba895c
  • SHA1 13b38c9f4fcad950f9e6e8e0fc1e7fff14d23a4a
  • SHA512 c033167e8cadfa9a739a7cf60824dd36e104a227d5b6f0ac78658383e13936b93680cfdd2100f5b5530d27a7b7a5c0c529a3e831c5db6ed4b0352535d0470b79
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionpersistencespywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2