Extracted

• • Target
    http___192.3.247.134_221_vbc.exe
  • Size 293KB
  • SHA256 754a492ef497df0dfb09de45b56ca338bda9d031275e388b356366fa29783039
  • MD5 61a0c75acbefb611e52b54e2ba31f9da
  • SHA1 dcdd07829c6fdee48bf0b18f5ac16ea4cd13c9c8
  • SHA512 7a1d580df52cca6b6cdeb5b7ef6eec05a09a8af33a9936295cb051108af0c535031a67fe8bac6227a15acf42a8b64ee5fa405130169b779f4d9792177bed406d
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2