Extracted

• • Target
    gunzipped.exe
  • Size 390KB
  • SHA256 84e31f5894eec64eb89b66b3630a5da22db8a7916fd51604c4c579a491506e0e
  • MD5 52a2246fc94b2b333adced3ae049012e
  • SHA1 3f50de8ae020d4f0b709f470c40201b61119d50c
  • SHA512 cdf56ca7463b442d75943d84dcb669eee458bd1330b901a7e21aacaad4fd32965910abf923b51619b029e83472c95b0211f66811d0b1a4721252e5317e267f72
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2