Extracted

• • Target
    f5f2de5391dc5dc8d55697ecc2d85e0a.exe
  • Size 179KB
  • SHA256 7e7fb389420084c8d186307502d05cb767293ec80fddabb73d7b1fe9e3654bcb
  • MD5 f5f2de5391dc5dc8d55697ecc2d85e0a
  • SHA1 fedf81c45aeb814ed5afb667f95168bdb39e1c7c
  • SHA512 cf79d23f06f4954304545fe1b246892ed9140622a314b0e2d5a8c2f757758f5b45fbfa7b931377e6687c454e979daf96606c86d69061f050fb1b501a02473176
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot Fake 404 Response

    suricata: ET MALWARE LokiBot Fake 404 Response

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2