Extracted

• • Target

    PO.25.10.2022PROJECT ORDER.xlsx

  • Size

    116KB

  • MD5

    2a36ef5ac23db260390c4571c6f9a477

  • SHA1

    1ed6db12fa671fe480c78b80ea19a6c703399a04

  • SHA256

    19fea993b7202c3eb16c7911707330a61bb9eefc09e548fdea419b849d04c09b

  • SHA512

    21290cecab613882ad25caa29eb84912ccf8441385f172f3a7b0737dac478d6b3dfdaf85fdd4da4c160fdf61a4759e3f4254da294fd06eb48f05566237806e14

  • SSDEEP

    3072:Je/6zK4qlPDY74XnfSvLawwsatZBQmln5VzAH6S5A:cYMvSvcsatZBQh6S5A

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2