Extracted

• • Target

    25a16ecd58f1e4d4519cee4cd646de26bec0a672e3c7fd1c344835451ff5e9b5

  • Size

    507KB

  • MD5

    9ea56e5bea580a497664cb61b8960d17

  • SHA1

    f3ecc2c727be56dc7d8e441cc20124824bddd46c

  • SHA256

    25a16ecd58f1e4d4519cee4cd646de26bec0a672e3c7fd1c344835451ff5e9b5

  • SHA512

    194e3368a5d275ff05efb302c296ae96ca6d661f8769513742521ef7c2e8d97933778cd4b666d87d83db4dbc2f30432bbd396fd1b1c4504c2685dc6267e79186

  • SSDEEP

    12288:b5kA4p6X3i5/i6a6GBCL2XzOVIk+FaH1X:b50n/LGUL2XzOuk+W5

  Score

  10^/10

  lokibotpurecryptercollectiondownloaderloaderspywarestealertrojan

  • Detect PureCrypter injector

    loader

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2