Extracted

• • Target

    a17eeeebd01e2b2756e481339a001b068a4bf04f6b2e7626b39b1e77063507d7.exe

  • Size

    596KB

  • MD5

    63c2c72a019bee6e49b658934f909336

  • SHA1

    2c95922ec392ee67ec941b7e033c055cbf0b9492

  • SHA256

    a17eeeebd01e2b2756e481339a001b068a4bf04f6b2e7626b39b1e77063507d7

  • SHA512

    372c7c7ae5037d072589bba780cdf682bbd6590a26fd3093871162f837e583df16c15438787bfcf8da1ec6c18ee00adf4179797e11ecc47eccb69f3f9bd66846

  • SSDEEP

    12288:KHwEV0vgLt3ZzZqZsENsXTUPYO0zqn4MHRifuoX0pWA0aJLZM/PxItBhIc+A:QwEpzseENa2YN+n1opiWiuPxqIc+A

  Score

  10^/10

  lokibotcollectionevasionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables packed with or use KoiVM

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Accesses Microsoft Outlook profiles

    collection

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2