Extracted

• • Target

    e14a5a244a1e4db82ccb8da0be57d841442851ede8cba912df309d3f033530b5.exe

  • Size

    344KB

  • MD5

    fcb423ac4af9801d133374c802e4a078

  • SHA1

    a955322df787c658ae72eb9e4ea3c41117dfd346

  • SHA256

    e14a5a244a1e4db82ccb8da0be57d841442851ede8cba912df309d3f033530b5

  • SHA512

    75ba6a412e9cf78ff36f34655061d269d840b9ae9f804f9581a899d49a84e4fe371b3971173d9bee140385b53dd95007e8d209d1bbb96522b4d99930766fd2f8

  • SSDEEP

    6144:8Ya6O4eRhQ9sVnQxU1vgT8m4ayccQrV/aXGGaoiNv5ZlG1arcEv7fCJ:8Y1eRh3nWUJgTsl5QrMWJ1RZvrc4fCJ

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2