Extracted

• • Target

    REVISE INVOICEPDF.exe

  • Size

    578KB

  • MD5

    e5af04f898b394a134c91d809811aed6

  • SHA1

    797dadafd9fde7db95ae65e63531333ad8e128b2

  • SHA256

    b00c6e64af8c667452a11c65123c37fdd9efec0eec3e05e1f03bd552edf0d8ea

  • SHA512

    4524016d55d99e296249caec2514bc83a125bf0505e11892bdcfb932f345a529a71ff583b8a21f7a5601b231c922abc7959b13135bfb3d68fc12a8a5f90c1604

  Score

  10^/10

  evasionlokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2