Extracted

• • Target

    swift.exe

  • Size

    437KB

  • MD5

    a6acb4165bc13eb460f2d7f2538a3601

  • SHA1

    4b8cfeaea522e2dbfc92ad9122c9f72db5cf7e7f

  • SHA256

    e29a407c913eda93bed5f660fee36a91126f56663ed20af7d6f812fe78308bad

  • SHA512

    ca0b785dc6d1dbc3434587e03e4fb377a65b3cb2d5fda6f2dcf570958bef04ad8fe0838ec05cdf9957c1e9a5df708b52a6430b93daf1ab0c0611aee48d13346b

  • SSDEEP

    12288:w1hTCPL1yajbUvxwzDBXKxmfvU+AjxOX41O2:24byuzD73AjxtO

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2