Extracted

• • Target
    SecuriteInfo.com.W32.AIDetectNet.01.12749.9448
  • Size 368KB
  • SHA256 ce21bc34fac3800be7b220feb16ab6aa9aecdec89e82e207c2b8201a9d3b3b7e
  • MD5 b7bc95346a7e3716d3a0020df3b5c786
  • SHA1 8502089e59311ceca51a04315f7402afbc45b244
  • SHA512 2cf82462cb0c19c18057f4c3f26d7d92d269aaa5d92e2928c1ad8f084d55fb78b84fabaf8624ead37f579ee96dac1abb05235ff8f100e4bf3dd78b85baced7cc
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2