Extracted

• • Target

    864951bb748b7cf1dac9a0a2801ea3db551bfc3d32f19fa2dae3861d52b6427c.exe

  • Size

    711KB

  • MD5

    8442630945fb45d52873adb092715013

  • SHA1

    477b80dcb20332c8883efda37fa5aca7a0daf4af

  • SHA256

    864951bb748b7cf1dac9a0a2801ea3db551bfc3d32f19fa2dae3861d52b6427c

  • SHA512

    5122b722be109c51ffc79b4c4ab21275c508adad731aa196d9e518479877df7db7ed37f4d6f442fdb8827b4670ef7abc8706d36ccaf6f2ae0223043efd706d7d

  • SSDEEP

    12288:yrS0gpQflQh/uEf13p9oX1zPx/6N/6tSbDvsUMkZ+9MBEo5ZlV:y2jpZ/Bf1fM17xS/vb9Q9MBBblV

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2