Extracted

• • Target

    -Invoice.exe

  • Size

    183KB

  • MD5

    2e7f6e052cb4f9700bb6bdd08df00e5b

  • SHA1

    2b880c88b06118959799fce8e1038cc5c91f4f09

  • SHA256

    1897e810d8f4a5f2ecd53a5abba88dca5d94137fd9e6427c7529313cc7af5196

  • SHA512

    18515e9df96dda75a43cb1561921e744213d98533039c4c556401143ce0d632f2bcfedbf9321abcd9c5ddf9fef6f6a6d1a17170dcb17b304a25ec73f7a24cb07

  • SSDEEP

    3072:HfY/TU9fE9PEtu0b1JF+aIglcYJ0Z0bo+Cb+ltRqv4NHZC6hENRymrW/RPyntK9w:/Ya6A1maIPobmb+HQAhZNytc9S1i1A

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2