Extracted

• • Target
    dab1d46327d46ccbade543f499379b66a9c71a392e96f3aa29f988301bc8b656.exe
  • Size 990KB
  • SHA256 dab1d46327d46ccbade543f499379b66a9c71a392e96f3aa29f988301bc8b656
  • MD5 9ebf8487ee2a54513df4a1bb442aa3fc
  • SHA1 980b9b3ea7d88604a855bb2aa2c929c48e92c7c7
  • SHA512 37574f1e64f33ad04dfa084792d41cca8141511b5e36b6469c0cf09bb13fc42f1f894434962a5e1946719b9cd65c80d4ca629dd30414824a76acfd7cc55f5668
  • SSDEEP 24576:7xlH0Rs/wyJ++KVqks7PzbthIRrNuevFOPSK80:NlH0Rs/j+FVqkcfthIRrNuevFOPSK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lokibotspywarestealertrojancollection

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2