Extracted

• • Target

    2ad8e1058109915bf9b3950a4247c1ef8e6346f82b2bf5d6a345f78b6c665957

  • Size

    1.2MB

  • MD5

    ec513ecd47ce56679ca56e4b4aafef74

  • SHA1

    e2b3452296f8786252a3ec4b3d9d269c16cefe30

  • SHA256

    2ad8e1058109915bf9b3950a4247c1ef8e6346f82b2bf5d6a345f78b6c665957

  • SHA512

    8d31fe3dc33cd4851194bf05937c597025fe042d5f03ccc3bc96d0a0c511d4f78f7060fac05785eb698ceddb02f0d9f7cfa852017b8af4418913c80d0c4e46d0

  • SSDEEP

    24576:Ru6J33O0c+JY5UZ+XC0kGso6FaCZlMucA7Mj0VTrs8LXNWY:Du0c++OCvkGs9FawMjw0Y

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2