Extracted

• • Target

    098f44e7799ce76f589bf48ea035a9b3.exe

  • Size

    188KB

  • MD5

    098f44e7799ce76f589bf48ea035a9b3

  • SHA1

    d5dbf72ae43c7f2e35ff67d831b2eb8036fe55e4

  • SHA256

    e7725edea9ad191d62ffe0f8cf45faaed5efed40ddcf3ed2f65dc258d82fc8fd

  • SHA512

    04cc91e8e1bdfcbd317a4a7ce4e88c52b334b7886e7fceb181be3477a8ecadfd7170a8b1dc6a03bf4072361ea74aaf476be2ccdc7c33bf65c41fb90ebf17a175

  • SSDEEP

    3072:HfY/TU9fE9PEtuWbEYvC7bNARXCDdnTFiuo9pEWCOsPpVTLOEum8XP++Esaz0M:/Ya62Zq7bNAo3u9+W9A/wDwzV

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2