Extracted

• • Target
    SecuriteInfo.com.W32.AIDetectNet.01.8222.31366
  • Size 518KB
  • SHA256 db19f1bef553dda6b33f8e792dc85c8bb8098826ecc41afe9be84ac3d73f7b33
  • MD5 d09ea2acaf3434c029fdc0fc96235da9
  • SHA1 053b14f81716329ed2c2f93806711f1f1fb6864d
  • SHA512 cfe59fa2a38a386593ac8de9fe36802695eabb62d6e1a90a799f4ce1644154730105243a432f605d1a42d5e9ff640b564eae57d21adb49925090be762961b8c9
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2