Extracted

• • Target

    a3ebc58cb7aebd21137225e16f6686642708e665fceb1f77e54c2413f6c0e706.exe

  • Size

    573KB

  • MD5

    0323dc105421401d34155403f091ecbe

  • SHA1

    f71675f7d669437852c55c308cbf3f25e0e923df

  • SHA256

    a3ebc58cb7aebd21137225e16f6686642708e665fceb1f77e54c2413f6c0e706

  • SHA512

    34a8b7395c2349ffa12036fc2796c8bd3b6f3548d1d80547e0123f50dc6e256b9c0ecf6b9cc0f928b80465e0ac3938cc51e26c645601660245f2edaf83af98e4

  • SSDEEP

    12288:AWYIPXjxannnHg2y0XA16s7Hcq7E4PUozHueE8frPRvd1aDkR:AWYIPFannnHg29A1zzHueFj5XaW

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2