Extracted

• • Target

    972ef638b803266c9fe4afce93a2f0a4a2a880b7a93a6c250209c55dea295ee0.exe

  • Size

    990KB

  • MD5

    9de9a50ec8399bcbea1697aed7f6b093

  • SHA1

    71997994585f06160d84ac92555b2eadaacfaed3

  • SHA256

    972ef638b803266c9fe4afce93a2f0a4a2a880b7a93a6c250209c55dea295ee0

  • SHA512

    c717604050139d6d7579ae90ebaf201f4f615c75b69163c2f0720ebe23448e6c8e88e1e91c8732ce6b4a2ff569e4c43e8e6d1fd09a148607ebbb75c9244fad3c

  • SSDEEP

    24576:7xlH0Rs/OSeKVTzAd9zpthYjMNuZ+FOPSKs0:NlH0Rs/OSes8NthYjMNuZ+FOPSK

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2