Extracted

• • Target

    b026474cd90b216f46158a276b4d11b33a84667780202033af851848360f60a3

  • Size

    666KB

  • MD5

    0a677370cc14bf3db9823dcd738dd0c2

  • SHA1

    0588dec65e9d11d5836ede52c9563e00d9ea63c8

  • SHA256

    b026474cd90b216f46158a276b4d11b33a84667780202033af851848360f60a3

  • SHA512

    3264442246ea0d3dc19d26aa78c88265d6eadb90ae029385093d363f70dac3cd6fadf6f023f70cfa4cd8a803589e15ec221887f75a9fe7c008320a77768bbca1

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2