Extracted

• • Target

    6fd2687a66899aa63357f7434a418b2bd873eebda9520129b20fd3e7e889ced1.exe

  • Size

    688KB

  • MD5

    4b905e6548f4d5040fab8962cb71877e

  • SHA1

    15c3785700d10e32ce7e17d706194dd9baa8442a

  • SHA256

    6fd2687a66899aa63357f7434a418b2bd873eebda9520129b20fd3e7e889ced1

  • SHA512

    75beefb8e58cc71f433980ceb6ff74c022d35332037b905e9e6644e09dea33ba36b41dd4c8e1e6874f302208fccd93ad258c74d09c08828d65bf7661026a3cad

  • SSDEEP

    12288:6jqnHvjNIrpf9rN/mc/CPV77Qykhe+AK9hCqAZHApvF1sdsgTWEmBuPg6AbTokR:6GPjKr5BNDAF7GAKeZHApvFWdsisBuoT

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2