Extracted

• • Target

    rContractList.exe

  • Size

    684KB

  • MD5

    a1f6d8695eb3ea40a59178c930235e76

  • SHA1

    ed59df0ace545909708b0c4cc73e94e9cdd373c3

  • SHA256

    b929a79e7f384cfa09b8af478710f6e377b81bfe01ac88716c87b09f11dedb79

  • SHA512

    bd50d88a1908cc8283b6bb1d6e5d2b2b7fe0eb35935890285cab6e7317abb284d32fe6bbd8df14d41e7778b3fccbd483b12ef7ad30791835e73b2af36765c124

  • SSDEEP

    12288:QbDzBa/mFiTEJ0+0OR8FCko2gFKzhqD35KOfBqmDcE8V57czD9XyjLb7sz:QP8ggzM35KkxcB57Goj/7sz

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2