Extracted

• • Target
    47ff8ccb6a8733906dfb61d7c03fde8c
  • Size 157KB
  • SHA256 1492c0e4ee79d6417b749a82c453357ea8a072aaa87ca6184b4d6a33920cb7fe
  • MD5 47ff8ccb6a8733906dfb61d7c03fde8c
  • SHA1 7a3c2b6abb8a52ee2dd313fa9c7907bbd02d97fa
  • SHA512 602e3e951b8efb22c92bb92b7b192ef8627bc44f428b4adb20cd74a118b487b33a0289e4abc5bc8c9e6b58fffc9dbf514990cdf2153654fdc6698c1c8781872b
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot Fake 404 Response

    suricata: ET MALWARE LokiBot Fake 404 Response

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2