Extracted

• • Target

    0011INV-PBS-BPPXI22.xls

  • Size

    1.2MB

  • MD5

    33a75ae52baa059c946ce63343977318

  • SHA1

    3f9a8c9b845e25c823236f55e803261611b7ada1

  • SHA256

    ee87371ff74c24235fb99de41971f23185587ee25030fe4abf0a6142101cfb6e

  • SHA512

    3dfff19d8d8eb90400773272e7e40095b299b8040e9f3b324a26e176f01929a934ce049c48544a268fa1418a8878f0863e888e69e0e9e3c8c5f7d43e2fe21c33

  • SSDEEP

    24576:YZyg5mMZyu1m35QsTYh2TDXXXXXXXXXXXXUXXXXXXXXXX7XXXXXCK8VIvsSXOJv6:KbQDTXK8xSeJvb

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2