Extracted

• • Target

    shipping documents.xls

  • Size

    666KB

  • MD5

    6ee345e07d729dc67be58d9f4d714cd7

  • SHA1

    e3048b4cb23be971dc02532a26a66f891ec50744

  • SHA256

    53560a2f4539618ffbc4951d192f9db8c9d196792cfd790489ebd1c107abba2f

  • SHA512

    dcbf0fcd827083f0183f06f7350cf059b255d472a0fbd91896369c08d04544cc7cb95b82fcc78bd2deaa4e73304082d243c43291edd99864e50889f59fd32488

  • SSDEEP

    12288:JzBYuizBZf8cAf7/A/4dU+6ZI7vsfXXXXXXXXXXXXUXXXXXXXXXXXXXXXX6:pBriB+ckA/2U+T7+XXXXXXXXXXXXUXX6

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2