Extracted

• • Target

    FedEx_AWB#53023114643.exe

  • Size

    558KB

  • MD5

    748f2d7afc9aab8fbd553c5b07c0ec5f

  • SHA1

    f92418c15a463d6201b32821ee9ef653db4a8600

  • SHA256

    99f0f330f7fafcc28267cc425f1d62ebf2a1604cd1843adec3a63e6631044d14

  • SHA512

    d9ceb997622ef2cff0ccb1613326bfe2efd22a1e0dc7e08fab04cf87a34290a3f1140219a461d727e8d9f9157d2c6793c2b07a30b8bbd5beb61228b5cdd996da

  • SSDEEP

    12288:nnUqvDQpIa40jkkT/lGrrH4GF3rUz9dKgXFZuz3kR:nFD8Iam7rHDezKgXqi

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables packed with SmartAssembly

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2