Extracted

• • Target

    45f981aa63ccbb8b5d389531c350e7efd4318a77b55c954d6601c797f4de580b

  • Size

    1.1MB

  • MD5

    32b5fd0e90bd572d14d9e08eeab6881f

  • SHA1

    59f5f97522f5b1bc6394efaf086e8b6cdd72a878

  • SHA256

    45f981aa63ccbb8b5d389531c350e7efd4318a77b55c954d6601c797f4de580b

  • SHA512

    aa1ce5d508f73360a8552bcca8598c1ade80a6ddb4b69ee3b06fb7b45f492d10826b596e27f0b1bb3d37195dc8a077c9946108cc71e107021627feb7c834d6fb

  Score

  10^/10

  lokibotcollectionpersistencespywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2