Extracted

• • Target
    gunzipped.exe
  • Size 649KB
  • SHA256 0eecd143d84fde7775035d32a7b7cfdce6a909f5aee9908b93d8d4a942da44a0
  • MD5 6a50fbdc73b780deb3112514ca444a27
  • SHA1 ae8f9fd93872553e89d52b0c9d0289d4e0a0fcb8
  • SHA512 b8c5ab37a3b57ef93686c8830bcea5adf93df732e6260a7172e0d87684707f0530a02660d634285bd06679a9ff02d55b49e92f75a4a7679b82d6b62a4e2bcd0c
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2