Extracted

• • Target

    d7e564b0c4a97f8d7d6e981bc78e0140_NeikiAnalytics

  • Size

    586KB

  • MD5

    d7e564b0c4a97f8d7d6e981bc78e0140

  • SHA1

    4f73bbf45bb5e1f49e2a556df46dcf62f4fe744a

  • SHA256

    8023da7bf6499317b973b0b423e6610f86a7107b778c4381cc9c3f42b145be5e

  • SHA512

    a8f0c29a3f3625f33c2238f2077f8273c4a6384b5a2e3fb6407ed059ebee53310708797f43b013283c3a43ce1ad8822b47189749e15e07a79eaac801b376d2eb

  • SSDEEP

    12288:yuTT2zB704xh6qVuovw322Ma3D6AiCBoh:yqT2z5t6q03CzLCBoh

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojanupx

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2