Extracted

• • Target

    specification T1O119H_Rev.scr

  • Size

    869KB

  • MD5

    512f5096a3736ef6b2ff63c940bf138e

  • SHA1

    e9308be425a6f5c029d53a7fe30138985df50c4d

  • SHA256

    5fbbba408dde7a9604d01e8d58fda635c12c00e125dd33c02222d41403a66d3f

  • SHA512

    716771edbcea28276106658581e40f5a4ba3511031f7bde9b23bddb723a147a689c181a281167ff6a69d42170b880673e2a407593e0062398932a1e12afb12be

  • SSDEEP

    12288:U9L6LYZ3lyUWHgKpmO+esiobYRLpeSm9DjiZjxs05xzkR:+uLYZ3lyUWHgKIO+msSIQ6+xm

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2