Extracted

• • Target
    GLC-2022-E025.xlsx
  • Size 237KB
  • SHA256 a2bf64f9550487c93e4166de3a40d1cbb85367197f2aef6d3861ac72a84ee5c8
  • MD5 ce715f9ac24dfb758644e8cf6ab97c42
  • SHA1 eeecbe772d91c6f28a991ee78e12b20e77af166a
  • SHA512 52fced2498de0f04c3f86548a67c03e656c3afed50c20722b2bccbd749d4a37c49756d5fe11c9e8ab8a7e106f0f6b35b8b2e0a31b2fcd2518630e3dbe30d5d5c
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • suricata: ET MALWARE MSIL/GenKryptik.FQRH Download Request

    suricata: ET MALWARE MSIL/GenKryptik.FQRH Download Request

    suricata

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2