Extracted

• • Target

    3791b65b31a3b12f458e042509119c60c2b3abd4f40f4da81f7404b6fb7db268.exe

  • Size

    735KB

  • MD5

    7733da960ee126b39752a737301c0f86

  • SHA1

    414d654545da349c21e58f0ae28021fe48a6f02b

  • SHA256

    3791b65b31a3b12f458e042509119c60c2b3abd4f40f4da81f7404b6fb7db268

  • SHA512

    9b9f4c0e926e76950a781713667cd4dfa34002a3340b99877730e7db67ea2a0dc7245518a1a943c388abc5dcd489737a1a88873c12deb028f788c8a3cd94d9d6

  • SSDEEP

    12288:NcrNS33L10QdrXjKDnuFeDnnHgnS61NNyz3Pbpv08kMZYS:wNA3R5drXGDuFmASO7y10gZYS

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2