Extracted

• • Target
    e95ec4d6653fd04defa43e0503d4314a.exe
  • Size 182KB
  • SHA256 d1741f7d3bcad64ecf32ff7826e107b80f79fe04e8b9d8c7bba6f6ddf8bf4407
  • MD5 e95ec4d6653fd04defa43e0503d4314a
  • SHA1 cbaf75ea7736a5ef1f08ac5952e2a627920c4b54
  • SHA512 f2863534ae012c4cd3eb63ff0807e5c65ab0d2793b70fd3b08547eb75710df7201381f03bdc70d61da692d2b1358d9b4b1cd0e4f6c2f8123971927ac6ca63b32
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot Fake 404 Response

    suricata: ET MALWARE LokiBot Fake 404 Response

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2