Extracted

Extracted

• • Target

    P084909424.vbs

  • Size

    616KB

  • MD5

    d49d1ec1abbfd72f724cff7b47ad9d14

  • SHA1

    255b5be08a6c41fdd0cc36a3aa0d1e053cfda137

  • SHA256

    437b8aeed7846a1bcc5a9ad86d3cf15e7c07945060b69b5d9e34f1d80707c134

  • SHA512

    fad9d15bdc9b826b842bf3ec365295a684ff6c32eb58749b748fc5ab408597335dfe5b3cb8f9244b152039a8412c48d489c3c6cfe97592941dd26ca16c7b7f7a

  • SSDEEP

    192:hmKZ++C+Hm+5+E+/+S+u+a+2+J+Ca+I+Y+I+L+V+v+74+B+r+Y+c+Zc+w+3e+qKp:gcgeS

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2