Extracted

• • Target

    DHL AWB SHIPMENTS DOCS.exe

  • Size

    44KB

  • MD5

    620d7b7b9c75c1bd5a921927cc833248

  • SHA1

    20822406537e8fbd03ec11faec991952c8cd134d

  • SHA256

    c707ec1a12a940e07233173f3df3203e32dfcbc5771c455300cd84935b4062c9

  • SHA512

    95f6747c0100f1dcc6481dc90cf2682412bcf9b40cc56b886f3f5b186875ed2acebffe6794c81967212173ff1f4cb3a97da0f3a42814d406770db679c5a0579a

  • SSDEEP

    384:k9JBtLK/tFBfGh0rGjb2RbnxUSlXAo5Ga+m3oV:0jEKibUOXv5yh

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2