Extracted

• • Target

    ace4774810376e5dd8bf3131c3dad03ae2c7d1d95a2edea39de42fec95a1cb19.bin

  • Size

    1.0MB

  • MD5

    8b36e207c53c0e34fce64a468d9f617b

  • SHA1

    fdbc6d03a334dcee2886fc42bc9280d9f7b590fe

  • SHA256

    ace4774810376e5dd8bf3131c3dad03ae2c7d1d95a2edea39de42fec95a1cb19

  • SHA512

    474402a8b4ade0eb1a0e70a44dbe20136e71a0728257f7a9af2da7c78de3fcdca13d76d70cbd906fe456c118ea7a07a932577f56c277fd89a64d1d9ccf907e05

  • SSDEEP

    24576:wNA3R5drXmDG6/e+vv+YG28w0LCLt6Oo4KLzsKT9+hUxAPO/:p5UB/BsFR+h6O/KfsKTgm

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2