Extracted

• • Target

    Maltrans SOA.xls

  • Size

    1.1MB

  • MD5

    373d4e1062b50a06f75c4466f7525cda

  • SHA1

    f54bc22b0fe5629f327c6abe6bfffb4158789b42

  • SHA256

    c3ce18f51c86cf5468df6fd3b2524e02cc77a425511b448a23f065b4b103bfe4

  • SHA512

    868dc1910472eb0a866c8eb8a2f6a24269fff132b78a8a2732954c02c2d0bacdf2e01a6bbac3ba4822807b1269f9fd03076d24ec98b74505af1f2658899f2e8c

  • SSDEEP

    24576:aLKJWQmmav30xj+MXUu9/45+MXUu9L3bVR+MXUu9p3bVAicubCdOQafIFi8:aLKYQmmQ30p+MXV9c+MXV9L3bVR+MXVu

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2