Extracted

• • Target

    Maersk_Quotation.exe

  • Size

    692KB

  • MD5

    b3654d3d061d7dc8c3b2cc9360c93e28

  • SHA1

    c697dd3dd48a1d333512a93b1e718b7b4c337b11

  • SHA256

    fceb05650abd8b77e8e0b2e685ccafd2c57933986a89334f41df39c8843a37e8

  • SHA512

    a0fb6d1fbba3a1bf0322367600e4ca1ebf95a1f23d4f5e4cdcf25eda405538d9c4fab996c9bca45d07cbfd7bc9b8e270a6d0e60b1c762b65d116f39bec1f41ac

  • SSDEEP

    12288:3Gx504bFtx504bFWx/I1w9hG/C1aVQxqPzzc37+:2w4bjw4b+IqaK1Zx6zG7

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2