Extracted

• • Target

    gunzipped.exe

  • Size

    587KB

  • MD5

    c5d4468a5ba8ba0e1fac05a48724a32e

  • SHA1

    1f972264fa9206cfa19db93cd0070f349d2138b3

  • SHA256

    cfe44cc7a02528dd5cb871658c28524245d3ead8dd3cbedc78815f0e02acb69d

  • SHA512

    0768111578ef8e385618be45a2f6d66d322f2544248f19b20f0c6081fbaf38df0bdc67e67b5ef4655eb5b021a27b9474fe772da5aaba8ac1d5384ea0b18310d5

  • SSDEEP

    12288:nEhR+Y72LKxA8UH25KC0JTzDsm514p47q8xrW7AkR:nEhn72LV8eP1Qeyp47A

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2