Extracted

• • Target
    Xysdzxaxq.exe
  • Size 177KB
  • SHA256 3eb2d6af1ef1c20fcb3887616aad430942beae25e637034110e9b5e9179e6b6b
  • MD5 83b5dfc150e08ef069b00ac265782cf1
  • SHA1 a2e45608e4ec82cba86ffce9c2d910e4a1877e6c
  • SHA512 3c5b3945d44b02b92423a0dba851c1d1688a41c6e3b316e0a0285336a02769718c9e7c6c6db318f8ad58ea2fe70cdc2c4285ee471052e92e00c1e56265f5ef3b
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2