Extracted

• • Target

    FedEx Receipt AWB#5305323204643.exe

  • Size

    238KB

  • MD5

    0e3d09ecb4359b1ed85d8239b65fb5b4

  • SHA1

    e41e74634e37c260857cd4d003056475c87e2f46

  • SHA256

    34c4934114c4dcdac5a0affe7ac3d2f37c5856579a9ede253c9e02cd12f76e87

  • SHA512

    a2393ff366d07c4259f638da935bcf78a27233115771e51fd61ef1a73bd4fc0a0f2f3abb845812ef651c92798a4179c42ef361d4d1564df00f259b3f703a1a63

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2