Extracted

• • Target

    AlezaMED.xls

  • Size

    987KB

  • MD5

    7cd6ff5343536a27080cf3125f1174ce

  • SHA1

    da0d9a92c6a097e5b70fb9e8d680c212321ffa2a

  • SHA256

    03d09bfd57e767cf1f87a74717297de4a48ed8ceec42ef6f77d1968dd9fc2df2

  • SHA512

    de375ab60ab0d361adffca59ca807eb046fb0c76dd5872986ce92b74ffe7c9d3264adbaf8e843c344e32d31f6771c91721a8b70187704a3d80dbac54d0b45165

  • SSDEEP

    12288:6h+ju8dTjV5FlT4Tl1BIxV5GixgBe2WFL+qlzL33WWRrNi+Q3pSjIi7:6hud//QT6xr36eJ0qV33WWTZIS

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2