Extracted

• • Target

    21f218355048519cbfe30b197a9ed5bb.exe

  • Size

    339KB

  • MD5

    21f218355048519cbfe30b197a9ed5bb

  • SHA1

    ccb176d3bbea60567dc52439ffc0c127fa6eacc4

  • SHA256

    de05f9c2ad13c543d4425f070e4608b37aac0b6d25c3816a8fd683cd8795a4b9

  • SHA512

    33e88f9b1f374c0c0ac4230876c661a2b4cf05de5b2d1dea46e5f55e4a6644532a95442b74d1e854e9036f9acd2f3c8c1825defcd450cf72fa468529e1feafdf

  • SSDEEP

    3072:4fY/TU9fE9PEtuABKs4fOzqEbeSgikfcIwVN2lQ7+TZe1tnlDcnvGyNWLHgdzMlx:uYa6KMwqGrgihpQstanvGyNWLHiQQBDU

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2