Extracted

• • Target

    SecuriteInfo.com.Trojan.MSIL.Basic.8.Gen.3430.21389.exe

  • Size

    304KB

  • MD5

    89b6536a7ae2ea35573a49f99d80f43e

  • SHA1

    f4b25d9cab0bf6b32b7fd368119975ee75775940

  • SHA256

    75f3ada6a5d7bf870af3e1f66cd00e437ae13d44a627d841239a4cbe5d53b1fe

  • SHA512

    ff4fd6c8bade289e4024545e1619632563c34ac2d64aa44c770b508327f96edfdee8a972c935989d2fb90601514dc2873e97948e4275477d2209d7dfa8528db1

  • SSDEEP

    3072:n7kikqM0F/M9xWttlRp/KzjqGCCaeeAWomPDL4VhBjnMvHlGDu2e9cMFGYhzFfqi:nG7WttAzjqljQ3IvHlouxcAG42uZ

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2