Extracted

• • Target

    RFQ.xls

  • Size

    1.0MB

  • MD5

    08260ba2505cbe73488e97bab13d291f

  • SHA1

    0772c758f4869a6a3c43479793e2f962cfb828f3

  • SHA256

    9c22aff1d30e396ef914d81ac057bac2d4d2bdb32fdd3d0ee83efec5a1fe0f2f

  • SHA512

    367f08996e7ae16334a3027d678ef45b46c02b38253ef668e77f49e91a5b70b242eb7e96d4b749f1a4208f222eff84ffdaf6d042e130338e8d03f4a98d6daffd

  • SSDEEP

    24576:Ar5XXXXXXXXXXXXUXXXXXXXSXXXXXXXXompr5XXXXXXXXXXXXUXXXXXXXSXXXXX1:rJk3a2

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2