Extracted

• • Target

    6682d4c801b131d5de5810898709e48f858f7204de3fbe9eedd08d7649202a4b.exe

  • Size

    855KB

  • MD5

    7d429931b4028877a01bc1b8af131394

  • SHA1

    237319bed39b32aa4878479043c74ef958f75df5

  • SHA256

    6682d4c801b131d5de5810898709e48f858f7204de3fbe9eedd08d7649202a4b

  • SHA512

    724d8e12592f2edc8d2e163b888ac80aa35d083cde9969a2241f1abf504a574d12ae105270a7882e4d68c8228a9905e5c4a5afbf7e19d560139871b3e021065f

  • SSDEEP

    12288:v3n4NBHPdHG2Qj8M+hFJHW8265co/G/DEl4MVonUp8p:f4NZJo4hjV5jJSiouU

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables packed with SmartAssembly

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2