Extracted

• • Target

    Shippment Swift Copy.exe

  • Size

    344KB

  • MD5

    8ed4cf27c1633d3c25e6980f5ee8d8fa

  • SHA1

    10565a5953569a1657afa4873401e2d8e8940f2b

  • SHA256

    a3c7d60f19310f7dbecce1acba480a79cc7d7839aed4467bdd3eb374bfcd68eb

  • SHA512

    4296e8bb86e2b6cfbedc8fe856bd66956cf1a6688ba1d19d9ccaae5544f62daf866329ab35bf20d541e7a161b21163c4f61346828cc923138ce4509a98447a7d

  • SSDEEP

    6144:8Ya6O4eRhQ9sVnQxU1vg8eE9N43l6lE/Ml6yZq0Shc8PGzAZ:8Y1eRh3nWUJg8eE99l6Uq0Shc/zC

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2