Extracted

• • Target

    Maersk_Quotation.exe

  • Size

    511KB

  • MD5

    f2d55ec329334c5d13fb1439f6754446

  • SHA1

    7461496b2116ca68460e5fa80028ea2415617905

  • SHA256

    e481570083647729483d0356cb21b4a41f9007e04ae45c7d35ea728c46cdd2f1

  • SHA512

    1c0a4434a011a9415cc545c89731c38849796f43b5305d9d779d6af5d74e7052e897e1e72f66dacaa3b50fa4ab4d142c26b50b47162ca983e262e8c09664b807

  • SSDEEP

    12288:Q5zi8LkpEaEzjKGXCHtoeVDLPTJ3OzEjNDAmTTRJgKnXY:Q52jE9nKGXWt/VD96EjND9Z

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2