Extracted

• • Target

    packing list invoice.doc

  • Size

    41KB

  • MD5

    28c91c3972300ec87144051e544ed45e

  • SHA1

    0b3c7fa689cc170eb46d6403c4e4f832646b9280

  • SHA256

    39768453c17afce045164d39f94da00f2e7278130702d41812924bd9c2c3a82a

  • SHA512

    214831419b83a4820b1334eb3da2443a4a0fac02f50c17c9db08510f06be57a7a18b761de9fc117c3c7ef579655ff57438ae48aaa69fd971f2299cd7916eeb72

  • SSDEEP

    768:cFx0XaIsnPRIa4fwJMeOwtqisMbMU9YjR7/FAIBixw0dp821Dhoqg71:cf0Xvx3EM/YTCV/FTBixwOpnoqgR

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2