Extracted

• • Target

    f6abd5c921b3194d507b71a74100ec437beda9a33627b254d0ed81e88d209bbd.exe

  • Size

    330KB

  • MD5

    0f3136e10afca292ec03a5a672724220

  • SHA1

    43e48db1fa8182f57b240573d0c655b16c3a9d73

  • SHA256

    f6abd5c921b3194d507b71a74100ec437beda9a33627b254d0ed81e88d209bbd

  • SHA512

    a7220fd9278893819ab515fc9b96673f6f66cf7fa65b77d2eb85699da200546f6fcf910bd07af9f309a3483d4695d76e249456baefa731c71657814d504be0b7

  Score

  10^/10

  lokibotneshtacollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2