Extracted

• • Target

    fb94701002816ee47f78f3712fef111cb1e16aba754f1df4a9796746b836a39e.exe

  • Size

    754KB

  • MD5

    8ed6f5c578a44b191a187624c4664d7b

  • SHA1

    834a8dd27f54f9c35045e34d8c0ac604516a3e12

  • SHA256

    fb94701002816ee47f78f3712fef111cb1e16aba754f1df4a9796746b836a39e

  • SHA512

    fa5e083b4480e329bf61cfa8e5faf1e4eed2d71c35c2422a3a5e267120b6087142d3cc569517957e7352d15f47a9977bf16e410e83fe78e166f1d441e028fd99

  • SSDEEP

    12288:b8+Ep9UQ8JibdmHrwOPLDbK8+FpeIdJqkR:b85p9UfIbULDbEeIdH

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2