Extracted

• • Target
    fb939013527820e569dcde01f26725f2
  • Size 505KB
  • SHA256 f478fcb271762bf306f63dee919c29bd496c7e9991d76d7bd6118b76334ffd80
  • MD5 fb939013527820e569dcde01f26725f2
  • SHA1 9a8aee71a2a6a475d9d11977fde71de4e9d2f7ee
  • SHA512 6f5ecd24115f18f06d83b1b4a7f7be1bcb64b93b12039925bdc70808d3b51e3e73b599c385352f68785fc619f5d2ec4f426b7af281a90f5b578944a5c3f140e8
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot Fake 404 Response

    suricata: ET MALWARE LokiBot Fake 404 Response

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2