Extracted

• • Target

    tmp

  • Size

    183KB

  • MD5

    2ee13ecd998734cd7fc80b882c7c3eab

  • SHA1

    93b675eeaf1da0de08d0ab9390baaf8d32967a3c

  • SHA256

    5ac52f3fe1e191e4f6c6e8f4ab8c5137dae75af22fe37a858e6b09add80b2dea

  • SHA512

    42e9924c1f28bee87d550a81e1628a74da30de05ea3b047627c6cb505ef99b9dc96ff5adb5679677249a4f038db3f8f5bf1ad80ae3bb9b48eedef5b5debb9791

  • SSDEEP

    3072:XfY/TU9fE9PEtufbLiHGXEXWKo+Gov1DANq78+ZzhPKfl/Ih3nU0ewEIcqEFYdUm:PYa6BeHJGoe478+ZzJKd6XU90hEF80No

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2