Extracted

• • Target
    1c313fe7562459e017b46c4dd280e88b
  • Size 233KB
  • SHA256 283011e02f08ea4c1dfbf76d7322d2034ad3cbe6f0a839267adcfe2a56fcb2a3
  • MD5 1c313fe7562459e017b46c4dd280e88b
  • SHA1 b42cbb395dd07114d23e390a82162005b1287617
  • SHA512 9bfad217569804cd260d4145643761fc264a7ef2021e6b80786487d9420b2c41521966337959c3409a23f899f7f1ab1148cce50f40e2cb6392f28327204a6fad
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2