Extracted

• • Target

    NEW ORDER IMP.xls

  • Size

    1.3MB

  • MD5

    beff0a43acfbdadee4b778952a27cc28

  • SHA1

    a4598522d27ec5027c3e9b29690c8e6392e5fe1a

  • SHA256

    dc54de15c8615d5523ba7ef2debf9a93ff76661f5c2f6e6d9f5cb594e753ee3e

  • SHA512

    8d376e2ae51ea9652ed27ed9b88486949a909dd23f96ecaa28b4c54e1a664cd648629afc326b4c8e18b6195311ddc1e5b832216de9be6504a1c53f9cb45bd9e6

  • SSDEEP

    24576:5LKKWQmmav30xl+MXUl3bVt3bVE+MXUu9O3bVf+MXUu9t3bVr1FYVCnSGmV:5LKvQmmQ30b+MXe3bVt3bVE+MXV9O3bc

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2