Extracted

• • Target

    25c3b63be2ea8b26be5050a732146c6f611dc335a96f80860dec608ece37bc4e.exe

  • Size

    527KB

  • MD5

    d8754ead54bc3ccd3bb50e726362aef9

  • SHA1

    d5c8560b76bfbf841db72e06b311f1c0346b20a5

  • SHA256

    25c3b63be2ea8b26be5050a732146c6f611dc335a96f80860dec608ece37bc4e

  • SHA512

    b7fd0cafefe3e6a35d38ee8b5da5bbe2d193dfab2d42e5b32b22fb833cebb835bd5290c26ed5e96f54a36d2d4aeed97ef229847e43ef927e3b00167155a5270c

  • SSDEEP

    12288:w+YifTFYVONOtTf6uxbTBTxOSbqojamEUufjkR:whiRYIruxb9hajK

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2