Extracted

• • Target
    0b9ad26b6565bdcdcffa310df4944096.exe
  • Size 156KB
  • SHA256 39cefe8dd528b6b8efc18753c0ee70e4c712f1cc5137e25564e2bb5cd3ff64d8
  • MD5 0b9ad26b6565bdcdcffa310df4944096
  • SHA1 28909e382df3f0853737d5961e9d7d8341bb1a84
  • SHA512 e68c2c9d6ce5c0ab2c1dc5201d732dbf6a8fdaf57271a415ba7573e98461da0a33bd1d544c2e3aca9b42dbdd19948c6ca584140e7394d05b3d371ae98fbfc1e0
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot Fake 404 Response

    suricata: ET MALWARE LokiBot Fake 404 Response

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2