Extracted

• • Target

    RAT.ppt

  • Size

    87KB

  • MD5

    996d8c68ecfe98a2ce25c177927a90e0

  • SHA1

    538d30afcc2d003f95c5f82714134957c8957159

  • SHA256

    20b52843f8e11a925f7008ffe96848e846099130c0c23bd80b3f3c6ee726e234

  • SHA512

    b9f2f992227632b86bcf2aad781738c2be173610bd41359fc581a89c7e4b44cac714385d28f7c967be2a31e8a3c33132aa6d5ced071d41c47aaa1f6c415cff1e

  Score

  10^/10

  lokibotpersistencespywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2