Extracted

• • Target

    c21f8d352d2afd341355721a5f12f288.exe

  • Size

    1.3MB

  • MD5

    c21f8d352d2afd341355721a5f12f288

  • SHA1

    39bcc6535cb57b87f1a6074408b1823b8cb5e698

  • SHA256

    b0e9ab8722211e906494335f94c75e0b7ab1bbd53b2b036e0b316daa11c0e7fd

  • SHA512

    e9afd875c1c7a2c58f082d9b05edbfdd32e703e4122ab5802a28c2b9426720e9dfaebedcaafe10e492f89b457a84ba602d9396cd9a130698dbab46c9aa83f263

  • SSDEEP

    24576:eCtDtoThLb5+pUBYf1hHsg20qKTCDiFg9JlN6UICNpJ+4zcCDdqkTzhjuBz2Wc:B8jqQKTCuilYEzcCDdqkTzhjuBz

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2