Extracted

• • Target

    fd2d0fbf84a26d2dbf9b64e57c4acef804d83eb2c5b10273c1642f9e8ef7db47.exe

  • Size

    561KB

  • MD5

    2e53a8a38c736fe1f0f4c68b5d0bb3f4

  • SHA1

    885c51f3c9189f89d1d5470279d61619165a3793

  • SHA256

    fd2d0fbf84a26d2dbf9b64e57c4acef804d83eb2c5b10273c1642f9e8ef7db47

  • SHA512

    b579fc70131b9f2820749b259436a02bc837af210bb8b33acfdd812731cf5d68c0e6eb71846a7f2e112607adfa83f745840a7e4c3a627cff5fdb744ead627cc8

  • SSDEEP

    12288:kCXCRa5WPw8w07xLNl/5ANKgaHfexlJvuToZ93IbmlFJYCHdDlY:bXCjo67pv1PHfKmTuhJYC9

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables packed with SmartAssembly

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2