Extracted

• • Target

    fe566ca240ef3e71e3e89148972262960bdf11281cba8354f262d834cb9b59f4.exe

  • Size

    719KB

  • MD5

    a8d0067c1cb89b67dacc3b904324a0e3

  • SHA1

    aed3b5e9b8d30880ea9c0e53247f83d17920702b

  • SHA256

    fe566ca240ef3e71e3e89148972262960bdf11281cba8354f262d834cb9b59f4

  • SHA512

    4e24a8863d223a837228afbc7a71bf37ac903ad383c97936432a7093b89e8b42a5f5e1b470c03edae83e218f48e3e4cab3c92c15c00dd9fda2612f06715cc863

  • SSDEEP

    12288:NMYeaky/Qa0KP1x+kPwu9Jx/mPGt/rFfaWtapLj/potZTO8Sm/njPOfZV46Bp6wI:NMYeleN5iW8p4K8SqPOfjpjxkVbf

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2