Extracted

• • Target

    d72cd36d04eff4046a372d47d39d2bafe68de8ff5833d4542c9b2dcfbe0bfaac.xls.danger

  • Size

    1.1MB

  • MD5

    163338c65c66db9f408304530bed6965

  • SHA1

    e5fbb68e2a59bf78a059ecf251c4b16ff0741cfa

  • SHA256

    d72cd36d04eff4046a372d47d39d2bafe68de8ff5833d4542c9b2dcfbe0bfaac

  • SHA512

    a7d16f41322adca2e5ef70397b03ef33b3d592d95e437f079129cbc58fb3d07885db1a417eb290fde20f510a2146248a1f7bf9a8843deb147c9c9d91d48d5872

  • SSDEEP

    24576:ILKpWQmmav30x4hyZ+MXU+WQmmav30xvBBb+MXULHOL97wZSw+qD2:ILK4QmmQ30D+MXaQmmQ30J+MX6Q7+Slx

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2