Extracted

• • Target
    FedExbilloflading 03112022invoice.exe
  • Size 747KB
  • SHA256 4433ffedfdc28e51850d2dd2673e44503a8705f2d31a7ac47a284111ddf33f01
  • MD5 60c9326b932f124d9dcb31d698eff7e2
  • SHA1 dc29523dfc56cd3c1f393c4282f71a345199c55e
  • SHA512 bfb74af104aedd4c1054f8b71219600343a8ff2fb811b0437fe9230442a349b2695abd1b1f8f7651ad21820f1884b6be1afa8138ff1e2eecf29e5a39d7681ae0
  • SSDEEP 12288:Ky6DVfs2sFLTAehm8buS89WOUNDixiCTpUlkOGfQZgIsYDPRwcNq:C8TAqbDh4x/TpSBGfQZLD2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lokibotcollectionevasionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2