Extracted

• • Target

    e609540945ebef9d1596ca2b25b84c647093c5cd2739bd956d65d78b0b3aa7e7.exe

  • Size

    555KB

  • MD5

    99c5c9172ae14aef0cad5d0882e08e0a

  • SHA1

    c60d974e2273922644892fac7100222d98345ca6

  • SHA256

    e609540945ebef9d1596ca2b25b84c647093c5cd2739bd956d65d78b0b3aa7e7

  • SHA512

    cb900ed675c41dcd5b68327c0812117998130f416313b219b7cc3c060a327033dca8000de4ab1c365b86d3868444a41af913c56c11525792f52d007ef7adb32d

  • SSDEEP

    12288:b4nvyFxAgk/g7jFq81pds1N7SEwNLrzHBLA3B1ELYisAY3iuzCjkR:bFxDOiFqspdUN7HwNLP/snyuzC2

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables packed with SmartAssembly

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2