Extracted

• • Target

    Packing List Invoice.exe

  • Size

    18KB

  • MD5

    1eb983cb5343f409473a46ad898c3488

  • SHA1

    942d68020f1f274d0001ae4a58c63cd82077788c

  • SHA256

    ec6e2886b43bdac92142daed19c7c4f1bdd03769a292c997b4f05c806bdc1968

  • SHA512

    9314a59abfe0240b1bda500443efd3bc8a7ee198b54b7c1964e0f592327bb37bea4141c04f91e490cdac9a97540d6aa8de57351a40222054769cf06d1edb86cb

  • SSDEEP

    384:NwnULFnwvhIiGkmHP5hRTpZvz7n7jWPiWVNLpUp8oCQ5nZV:+YNIyxJB0ZLmIQ7

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2