Extracted

• • Target

    96cf27ee35af69887dc20d882b0e2b82c21ead56700b776beadbd99ab6d27d16.rtf

  • Size

    336KB

  • MD5

    e11c85d6890e5b25aa448b3a8ed79057

  • SHA1

    cf57b870f9e4f516fa35205cf4047548d8985abc

  • SHA256

    96cf27ee35af69887dc20d882b0e2b82c21ead56700b776beadbd99ab6d27d16

  • SHA512

    27f18b3409d318979633c23620ecdf4f859c7411e5cce23c04da06063f06b4af3b0fc6136ac024348fe0ea394902538e6dd5448c0e0f47cbb6caf9019678f0be

  • SSDEEP

    6144:EwAYwAYwAYwAYwAYwAYwAYwAYwAYwAWr4nd+1FKiZ:K

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2