Extracted

• • Target
    RFQ 61340.exe
  • Size 13KB
  • SHA256 72a9943b3ad481e16f7395e0f23cdf40e6375150375f0939803b2cf19fe7eaf8
  • MD5 0ebb5c74feacb46c1196a9df0389fddc
  • SHA1 688ccd6defd7625ad1bf52d82444e7bb5edd15e5
  • SHA512 2ec3cc32dcbf392970c103c9c5fbf82d62f9dce5be131b5a8f2bc17136cdf74d660abcd1bd4dbc7aa70f2e4051427dc91cfc7915c5200bef2078401abef28a39
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotcollectionpersistencespywarestealersuricatatrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata

  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

    suricata

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2