Extracted

• • Target

    rev 876-13299193 HAWB - MAWB.exe

  • Size

    564KB

  • MD5

    51f29262c7709e7691b063f7b714d794

  • SHA1

    7f7d04e0be1cc4afa7f66f7ab05f5b0a1c03ab1c

  • SHA256

    b63a70ad6b79d25bd29b80af9a18661b86d78ed2b839bb62484d0a42ea9e1608

  • SHA512

    d0f4049384f3bfff69f0323e47b6e68959a3aa09c146e020dd52d63e1fa5b8a9b7ae5677e3a54f3322a1b77b651e1b9738439df8e8a52313b0175993a5d75a15

  • SSDEEP

    12288:G3zLlfSc7QPtJlaD0FRViJtH8yhzt1u+NYxtp5NxSpFSK3:0hq0UJaD0FRShz/DNYxvBSLS

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2