Extracted

• • Target
    RAT.ppt
  • Size 87KB
  • SHA256 20b52843f8e11a925f7008ffe96848e846099130c0c23bd80b3f3c6ee726e234
  • MD5 996d8c68ecfe98a2ce25c177927a90e0
  • SHA1 538d30afcc2d003f95c5f82714134957c8957159
  • SHA512 b9f2f992227632b86bcf2aad781738c2be173610bd41359fc581a89c7e4b44cac714385d28f7c967be2a31e8a3c33132aa6d5ced071d41c47aaa1f6c415cff1e
  • MD5 SHA1 SHA512

  Score

  10^/10

  lokibotpersistencespywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2