Our dynamic analysis showed Lokibot’s behavior, including the benefits and drawbacks of several unpacking methods. Lokibot also used an infected system machine global unique identifier (GUID) value to generate a mutex (an MD5 hash) that acted as a flag to prevent itself from infecting the same machine again. The subject lines of the campaign messages usually started with or included the term “proforma. The malicious attachment was a DOCX, with a file name that also included “proforma” in its pattern. TLP: WHITE https://www.us-cert.gov/tlpCharacteristicsLokibot is an information stealer; the main functionality of its binary is to collect system and application credentials, and user information to send back to the attacker. We conducted dynamic analysis to observe network and system behavior once it infected our Windows OS. It starts from the tenth byte in the data section of the initial TCP POST request. The binary’s hardcoded strings provided data about the binary’s characteristics, behavior, and main functionality.Section HeadersFrom the section headers and distribution of each section, the binary appears to be fairly normal. There are no unusual sections, and the size and distribution of the sections, especially .text, mirrors a standard unpacked binary (Figure 6).File Metadata and StringsThe binary is a PEx86 binary, which can be run on both x86 and 64-bit Windows OS. We determined that the binary was packed because we did not see the C2 URL or any signs of being an information stealer (such as an applications list) in the binary strings and resources