Extracted

• • Target

    4374b456de9f3d32c1d08df7bdf2ca3d17028403e7a907cd3663f2cf684be5be

  • Size

    854KB

  • MD5

    81884a6ffda98933dca040a4af64b398

  • SHA1

    0fcc57fe62da68bd59a7b52b524bda1ed33a3059

  • SHA256

    4374b456de9f3d32c1d08df7bdf2ca3d17028403e7a907cd3663f2cf684be5be

  • SHA512

    8e4211cf916de10d0a014b2cb1d4ff50068b5582301c080590351a8627b4467088c36a3029ad98ced2b8c7bc3e975bebb4524b47c1af9b39795b3659a470c398

  Score

  10^/10

  lokibotbootkitcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2