Extracted

• • Target

    7WB2771.exe

  • Size

    726KB

  • MD5

    cc52768fba25339bb3c573ce685bdd9f

  • SHA1

    a8b8bc429b23081d830834f06df68b1b655980ec

  • SHA256

    b7e6fc48e8a381fa0413834a185577a49644a8da2265bfa4e762703f89bc16a9

  • SHA512

    83d62af8a730aeab0e4ce5685d8ded1f12bdf186afdd20f8e18cbd26ba9ce6397e03b35137d038d02cd86e98246d9dda5729b643e798a517751c0f4a66769148

  • SSDEEP

    6144:y9S7DcJsGXdXQ5ze+OPHFPxvhVGFzNBJuYsU0mvoWVMNe3fSTFwwy:yS0zdXQM+iHlljouYBlzGwwy

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2