Extracted

• • Target
    REF AMVK22-3480.exe
  • Size 13KB
  • SHA256 cb0296fcb9331c1896041c12cce327ef3f1801bd9dbb177bacc6b42a0d391e8f
  • MD5 38a712901833078d42e10725f33ddfe8
  • SHA1 135fe9822496e1b05f8430281cfd30d3a03ff8bf
  • SHA512 d8efb1587ae8a992cb902bd57e65bd555c18ba4c1132eb08f4644874e27cc3b9a80dfb623c53ce4c27d8c0d63b0f1dd72b83f07409fa3bea0711a82cca8df082
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionpersistencespywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2