Extracted

• • Target

    5b35b93ac36e716d98f54530aed8c547f603b7fe846272eaf722003549d822e5.doc

  • Size

    314KB

  • MD5

    156adf696611a249b7ab452b257d6395

  • SHA1

    cce0c987e8daa43610a655fc32080d05e9063791

  • SHA256

    5b35b93ac36e716d98f54530aed8c547f603b7fe846272eaf722003549d822e5

  • SHA512

    0e5ed467433416cc83231ce518cc97cdb5bb90935ed2bc7a89eb4e747ffb63ab6ec582a2281f550439a3145e41e865a60a5d51906ad51b97082c5f490660cb8a

  • SSDEEP

    6144:kwAYwAYwAYwAYwAYwAYwAYwAYwAYwA0xs:Us

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2