Extracted

• • Target

    454e87da084f762d25dcb7858795f6bb6cd549cc0f1435177121b0eb66c17743.exe

  • Size

    490KB

  • MD5

    a8f86e43a86f3e0047342917a3b4d823

  • SHA1

    90e606c3aa0f2e7e438ad0eb4e43a391adf7af6a

  • SHA256

    454e87da084f762d25dcb7858795f6bb6cd549cc0f1435177121b0eb66c17743

  • SHA512

    794f30895e43498d59449f680f6298b09a947003ff7f09a33ed2241a16cf5bfcaf06968511bf95e2d4ecb2554a19ca936396e21128b0a32bc9e6ce636ce6c6d5

  • SSDEEP

    12288:Yes3/5HnQc1x6qDCRSMXZrT12L1fRFen:zwBHN3FDF0TMRfR8

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2