Extracted

• • Target

    MV DOBROTA DOCS INSTRUCTIONS.xls

  • Size

    683KB

  • MD5

    e7fd9fc17216ee5b41867a90b6514813

  • SHA1

    a91392847605ea2dd4cabbb0b18c8a4689517798

  • SHA256

    36bfe471de8765f11de3ca3fce2a6a9b36d47ad8de09cc79b6648f09a653fd88

  • SHA512

    06367fdcaab3ba0290b67b343498fd74576d0f3341fc04747710b3448935e087c8e64c01d9937dc9c5f1ba295bd3db2f85ba691c4802534eab9b39504a0af72d

  • SSDEEP

    6144:U0rC6zzXaMANkizCBDEk2sG3figF8ESbuQD9cBmSI5Tj0rC6zzXaMANkizCBDEkq:t9L5Tb9T5TEwFSZDIlr

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2