Extracted

• • Target
    Rag Sefid Project FITTINGS-AG&UG.exe
  • Size 201KB
  • SHA256 7f2711dffffeb5989c868de4480e0d84887ae4ae36a010558ea68c503b3161cd
  • MD5 cf96c1c9dd6bff77458a131f6f77fddf
  • SHA1 b3b5e1c38eb6de9d244cbc628598af568fcc308e
  • SHA512 4d66074aa00655d8215aa7ad1a821525504418536c46ab9fabf753290d9c4ba9b93882995bd533411891a82a67122623dcbca9adbc61a2da4bb7d5f944d219e6
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot Fake 404 Response

    suricata: ET MALWARE LokiBot Fake 404 Response

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2