Extracted

• • Target

    d52ee6b3ae8127828700bc9b3abd6dff

  • Size

    1006KB

  • MD5

    d52ee6b3ae8127828700bc9b3abd6dff

  • SHA1

    145bbe149069388e25c1f760269549baea73faf0

  • SHA256

    3a33001ae12c200a137fde861b00f08e3afb05ec56ea4331c3ae1606e31f4c79

  • SHA512

    0ce058ed5f8362bc2f5dc4aa946f1750aaf57d51648a6fa48e4ba5117370a62e476c9aea72e9ea0ba008f0e1de36a4c2c817a7ffcf173739691850f41d545f05

  • SSDEEP

    12288:SWRVjWCtfexO8AT5/d3XitoBoRoDoyof+DcC+49Qtrf3xilXupTRA85DZ5dT:rdr5/d3+K64JbDx+49Sli5QRzDp

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2