Extracted

• • Target

    8f9bed5d03737615e413841056b188061834c62bdb4511d169cdeb117c2af4c8

  • Size

    715KB

  • MD5

    527e417d7bf0c62853a5b0706eb11855

  • SHA1

    b49bc435fbb5e3eb92dfbd919acb50df31912ca4

  • SHA256

    8f9bed5d03737615e413841056b188061834c62bdb4511d169cdeb117c2af4c8

  • SHA512

    1f9c9e8f945c54eac35e9c69f70864858fc5ec4094cbb1a430def647ffd085ec47186d08a4bd10c6cac224320f76f46d5c1c142153bf3db16e0944534c1f00e1

  • SSDEEP

    12288:9l2pxDLJipbWXOVISPnnkFsoIz5NhNFZxzxkyUH1zF:eKbWXOVPnkFAz5tHxNkrH1zF

  Score

  10^/10

  lokibotspywarestealertrojancollection

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2