Extracted

• • Target

    FAKTURA #180222-PL24 i #160222-PL71.scr.exe

  • Size

    1.3MB

  • MD5

    6ef8daae20c84e0db211690a0ad97a98

  • SHA1

    02e9b763d21087a745781ab952c20ea3ce57e3b4

  • SHA256

    877cb8703ca12f80a724652ad436b8b7678e718c4ee009d61b47217c8443180d

  • SHA512

    aa0780a3a7b61d62cd62d4d80b808b332f2bea7aa95482122156258db9773040cb48899854f5ca99a5bb58949cc60f5cc545de61882f87f3c8f6c439cf9891ae

  • SSDEEP

    24576:GnBFEzLlVyPFK0IxsyRAJ2fPU8wgr/8iEFAfoEKyqoGGHf2dG7Oo/H7:GnWbX3kmU8trE45h2dG7

  Score

  10^/10

  modiloadertrojanlokibotcollectionpersistencespywarestealer

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • ModiLoader Second Stage

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2