Extracted

• • Target

    43101199-98da-4e13-9aab-1aed2c063b07.xls

  • Size

    1.4MB

  • MD5

    c2cde165d9299f03a15c44ae27573ae9

  • SHA1

    4930a00f6e1ab9dcf225dc9895e8a5f312775b3b

  • SHA256

    493119c2caf898cdee17932a4f67d5944212116cf348499c4c1dcc6f6d48e5ac

  • SHA512

    d64c7cf317c7d26834c6fa5ba07534bb229c4a8200f1c65716ce102692e7d7903a0b075f6cde83fdb3c1e387c7533568fe95e9dd62174ba015429efd0bf865c5

  • SSDEEP

    24576:Cr5XXXXXXXXXXXXUXXXXXXXrXXXXXXXXXQmLHmTGFZIk18gFE/Y4UkgLSLcELEXT:nAoZIgPRAcAAe1

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2