Extracted

• • Target

    12f0fb53c3eda4a327523a3ad52ebfea151b7b3d88523c8624905af43ea781a9.exe

  • Size

    589KB

  • MD5

    aab1d3c0633ee5a766395a51c4b4cf66

  • SHA1

    30ff72fe2d42c22c85ff64d761b0a90f385fb0de

  • SHA256

    12f0fb53c3eda4a327523a3ad52ebfea151b7b3d88523c8624905af43ea781a9

  • SHA512

    38668792bb0c9ae16c3dedbe07ef744b43bc8784472a40eda1e803789c705e8fb765f01766e54ff4ba90c56f28c30ee30e72783223bb7fc8b432a857419e3ff4

  • SSDEEP

    12288:cu0pei36RfpKX2KnlNkgkbZne+G4jKvWy5OfQ3FXVvTI4nqvqskR:chpp36lpKX2alN+bh75evWy5OfkTI8qg

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2