Extracted

• • Target
    652c23a2826f489186a909e1bf0d811d
  • Size 498KB
  • SHA256 dc567ec4e012d719e078ce163f7c993274b16c1124f025cc87e23ce641ecde2b
  • MD5 652c23a2826f489186a909e1bf0d811d
  • SHA1 4d0c5f5a45b16409f91a2d8c3d7cce6322346f29
  • SHA512 91b8c75cc7a700e0652a8ed8492da1dafa3b337f91534104d9561738106413dd7af58b5380c2c474579b88b8bbf97f0807fef160ad0916e8b3548517b5fcf501
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionspywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot Fake 404 Response

    suricata: ET MALWARE LokiBot Fake 404 Response

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2