Extracted

• • Target
    8fd789dd2cb93be5bcc0cc555e3d0224
  • Size 155KB
  • SHA256 4d05ed5d5deea64d74e00dd818f36afe2b7fa7effe971cab1aed950cc1976871
  • MD5 8fd789dd2cb93be5bcc0cc555e3d0224
  • SHA1 222c6e707d04977c854d286962da08fd7e5bd688
  • SHA512 263173f52e8bc6ae4265afc3fb60d502907d11267dbbabef4502b74b252680a2b2d6ee2bcbca3e6a1dbf6add3dc5fe7643d58624399f81968b182338cc3cde76
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot Fake 404 Response

    suricata: ET MALWARE LokiBot Fake 404 Response

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2