Extracted

• • Target

    9bdd98699b762b74ca46e1b3e5f7ace8.exe

  • Size

    174KB

  • MD5

    9bdd98699b762b74ca46e1b3e5f7ace8

  • SHA1

    d7c6821d9d06186ef3246f151ff35dc6a7208600

  • SHA256

    0f5bef2f38014785cab2782e9dc0dfc0841293ba4f230d19cdc8046f251ea84a

  • SHA512

    5a26a69c739cf9f44a7497b3ef41b8988238c33433f8c4979b3eed63a45fa8f114be911a31bd35faa5c56e2ca480cdb300c9fb06eebce15c842666a161de4241

  • SSDEEP

    3072:WfJSq+ytGIon9KcSMf/RQD0bZfV6UPNdDQmalxVpijteSHRfsjVdNHEh1DbzsF9z:MEa0NfZmdU1dDZO3UjteS5id41DbAZh

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2