Extracted

• • Target

    d81b40d87d7caee2e52fa109131ce7702810c9fb0f98f8a15fdd72f14146e513

  • Size

    740KB

  • MD5

    a305fe5a1a2d98b54d9acfb97f2d2525

  • SHA1

    a9a03774732c584faef112beec2605d333b4181c

  • SHA256

    d81b40d87d7caee2e52fa109131ce7702810c9fb0f98f8a15fdd72f14146e513

  • SHA512

    8aeb61df7da99da3854c534c07c348f0d89cd1174722f8ad3a72d6606bb9cfb420afa3465f42a5a8fdad20b1a226ee157717c047607321d887bd2406f3ccb71d

  Score

  10^/10

  lokibotneshtapersistencespywarestealertrojan

  • Detect Neshta Payload

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2