Extracted

• • Target

    fa6983c115c33071019401a5834168290aa5e9ae0d965c84ca94a052a0514d7e

  • Size

    2.5MB

  • MD5

    a85c8f8fef95e8f66bfce306d9ba4ca0

  • SHA1

    f0f32629881f38091a1b4e4780a262151ab80419

  • SHA256

    fa6983c115c33071019401a5834168290aa5e9ae0d965c84ca94a052a0514d7e

  • SHA512

    995d46875256301ac5436ff406c72134904e9f68d8d38bddde38d42bd955dec8c8fb141399acac42e3fab8db41eddfac287aec05ba77e219c8875f91885ceb78

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2