Extracted

• • Target

    M_Q_Y1Ej4VjWZgewTLH.exe

  • Size

    534KB

  • MD5

    9ed68355ef6820590c390427106b00ac

  • SHA1

    d27110fdc64f51eb35a36dce2949dd5d8be42e97

  • SHA256

    69a816dfa9904087580a962afb9fff845ff5ce6e33bd8ec6a20732604d6bc556

  • SHA512

    a88b804a5c9a9e432b8bd93c2b50a9ecfe1745174fcd4094af86bf133e482df2ec6860b18fea982ebb9de5e172792032e9854eec0bafb884b7b5e8043fa245e3

  • SSDEEP

    12288:1bBPJwKcIZRLsj4lu1SV34dRYhooWgtfM:hBhc+DUw6HoWZ

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2