Extracted

• • Target

    privola za obradu osobnih podataka Ԍdpr ps․pdf.bin

  • Size

    557KB

  • MD5

    37c9e52caac32b6d7e9bd2e536eb4dba

  • SHA1

    1fbea677fb87a89e5033b00fa6d49c415ad6d0cd

  • SHA256

    e55fb10a0399bd809bfc4cf4954bd895c6bf5136f49cb95534b69b2515b73d87

  • SHA512

    505062c1b583ec0b7412dd21d4a6c080f8baeff931ba35c28e81b5f394ef74b15bb152edf8ca43278a8b17e081dea67c1f60ffaaf305f35949d271986597cd83

  • SSDEEP

    12288:13sRKt/rFfahJMqDU56llE8Nwq3bWGv4yjOcOITneTg:ZeKN5ihJMqD5EWKGv4MDjyU

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3