Extracted

Extracted

• • Target

    441adbf25c61c2a9cd0d21e2b492985bfbfb7e728edb4dcd53e3a7d8e652e9a2

  • Size

    620KB

  • MD5

    d5242869385cc6f80a3573f30969d32e

  • SHA1

    804b91d679866e9c9a8f84abdc203aa5ac6069ef

  • SHA256

    441adbf25c61c2a9cd0d21e2b492985bfbfb7e728edb4dcd53e3a7d8e652e9a2

  • SHA512

    4aa4622bf2d4e23a46ffaa47e7e984afacba5a3bcbcfc872c85b9a5d38e962b2bd59870fedf81375ceb1eb87f493e0079ad0925beccaf50d63e7c30ccfda0a74

  Score

  10^/10

  formbooklokibotracollectionratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Formbook payload

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2