Extracted

• • Target

    31889820ee1563f02c415ba07e2220b0_NeikiAnalytics.exe

  • Size

    619KB

  • MD5

    31889820ee1563f02c415ba07e2220b0

  • SHA1

    5f49d38935524040e6222897077c6393e1d14a43

  • SHA256

    e05c517fb4a915b142200ca5dfe2e69fd579a2ffbfbcafc2b4d478163d407b09

  • SHA512

    1340bcd80292531773da8bd766ab579c2ee96c6df0258775a8e61dd252a7c823afd26e56615c0835cb1073f7f21b4319967a456c076bd004b84fa2bdcca50810

  • SSDEEP

    12288:0IqWET/mr9K+22BEEzFatnPvEOwWkIai6YpgnNMuskRBqdQV3i:4Wtb3BEV8OwWklPYyNMy0QZ

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2