Extracted

• • Target

    Shipping Documents.exe

  • Size

    90KB

  • MD5

    0ccf418bcf41e790cb09787062bed80b

  • SHA1

    54f33e1f18a5f33c755779e0335e8c1695deb20d

  • SHA256

    8b8936901557f02c5a2a6821394d35f0a21fbf13fd78519e0c778ad047f1eaab

  • SHA512

    4796ecfaa6edf7be4b9105afccc645c61d415dbfd8aed8e4aa1db1bf47e00ed1e2fc528123a600d881d06d078beb96c787360da7e9b1b6c3bbda81a8c0ce7cc2

  • SSDEEP

    1536:6jpUUbAtT7oF3vWQ+Gwl+cSM6UGtB/EK8W6yp910HjLYm/zCwlt+xH7zP9:qUJoFfWzzl+cSM6UGz8Kp649qHj8m/zi

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojanupx

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2