Extracted

• • Target

    5f6d0070aa1b62cfb032d99a822b585b79d1d66125cbf16fe03d7840f89cf7cf.exe

  • Size

    517KB

  • MD5

    fb8fa0c1aeb88692b1d491829060cc20

  • SHA1

    aa6bf7d25927b3e125a77a33086d40cb7e44cd7a

  • SHA256

    5f6d0070aa1b62cfb032d99a822b585b79d1d66125cbf16fe03d7840f89cf7cf

  • SHA512

    f190f0a6fd33b35cd53dd99aae15bede46e50e8fdd09ed77774b43ec011639f03def9b152c4ce3c26d7c216eed52c8b82ff096b0d259f214b7b6ff90ea64af42

  • SSDEEP

    12288:JuOXNuRchitIqBldvAaNUlIl+EQmnM86UWPeBc4FU65s7E++y4BZpx:hyjzn2lArpfWPeBc4FvbJJz

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2