Extracted

• • Target

    DHL PACKAGE DELIVERY - JPG.exe

  • Size

    248KB

  • MD5

    7597be45c875ab263b477b7e168b4d82

  • SHA1

    a9f82f1d489ec2da4cb8da87246715a4f036b7c9

  • SHA256

    432e7077214ceda59a7af2e405a37b09fb97455a2dfba3c83832ad087eaedc30

  • SHA512

    5ba03e286e0e555e64c3818f053bd8c3134cc8064d82a2252945257fc157cd0ac2ad9975d529f588998cd2410cc4b9c7a76a8e19ddb18764a258ab8fa668b0c4

  • SSDEEP

    6144:AmGIha2fc6BiVDNob16O7Hq99qv1OckGrPWqvD18h:X22fc6koZ6G2GrPHvD18h

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2

• • Target

    $TEMP/System.dll

  • Size

    12KB

  • MD5

    0d7ad4f45dc6f5aa87f606d0331c6901

  • SHA1

    48df0911f0484cbe2a8cdd5362140b63c41ee457

  • SHA256

    3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

  • SHA512

    c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

  • SSDEEP

    192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

  Score

  3^/10
  behavioral3behavioral4

• • Target

    $TEMP/carritches.dll

  • Size

    72KB

  • MD5

    c71e507b870b4a3d412ebf32807e3ec9

  • SHA1

    df1b2e859f0b4adf31c83f2c6ff170d7c3802174

  • SHA256

    4ce8d5ab293bf630573a86d6cd80862facbe2ee03170db808b5567730b5aee99

  • SHA512

    dfc433ddb23f1c73d4d688189e0cf180710d8210d4ec9332bfdeea1f6cb53b04ecc647d200fdaa476f4518a28544d048e3808af16a6c58a2f018b63042dc9720

  • SSDEEP

    768:L/KmoG0U2PH9sFj9TF7jC2W5ZW8G/WzYqorlXv50KnV+UTk1tn3:L+Vt9srF7jcZW//WzYJXvqKnY/t3

  Score

  1^/10
  behavioral5behavioral6

• • Target

    $TEMP/rating/dirname/tos/lc.exe

  • Size

    36KB

  • MD5

    d75bc7c5c9cbe540d5a7b353ca3ad8af

  • SHA1

    79db387f0698893cba6a7d5a65e7661e9e41286f

  • SHA256

    d4ed7e3418e142b49392766acf2883c79346ee8f9475fdd6d0b9bd71e2547d42

  • SHA512

    e770f247eaf9f0b745a57cdb0eccdbf95e1edf5d9a79d4b8e1ee1c7ff7c37b4d5e39223b3cadd69c6bcd59fc03199e76a8d5df71898306b600ba803276043857

  • SSDEEP

    384:QQ9pEZKM5jMAzhvoPMHb7Z3Ya4X57g6ihJSxUCR1rgCPKabK2t0X5P7DZ+3UiKeF:ZMZ9MMHbo57FRJfO

  Score

  1^/10
  behavioral7behavioral8