Extracted

• • Target

    Shipment Document BL,INV and packing list.doc

  • Size

    34KB

  • MD5

    0ac08a867e4f5049f0485a80aae001cf

  • SHA1

    4b8c3db3b216914d6df72ab6a4bf650bcc420fb1

  • SHA256

    e3d37397e7191006598d4b0c1f1b252ae97dd88770c10d26e9e8859eed09bac5

  • SHA512

    71c7feb89b7e563573c096231d142b92e39f54187eacfc1b85bb49f7e492e448ef2338fdada45c3f0716f2b7034f807c7dd1477df83210fdf41336865e989c21

  • SSDEEP

    768:EFx0XaIsnPRIa4fwJMlVfINH1zoabIy4EqNzqPRS:Ef0Xvx3EMlVfINHNr4EqxqE

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2