Extracted

• • Target

    Maersks_Quotation.exe

  • Size

    558KB

  • MD5

    7e7cf728c28c04d181a53b7a1f1040ec

  • SHA1

    adaaae1fc339becd50905220a5fd1b88b3b8baf0

  • SHA256

    6968fe8fcbbb5e1b6577634abf33c41d1fec5feb5eba4146595520e636d3291b

  • SHA512

    6140d4d28279b64914793a1fd3384c973c7177abd8b08b836c2a5dd850e91d41f7a23001e43245b69d1ae818920bef8a7043896f837ac29ad9b605eed711b0df

  • SSDEEP

    12288:EN3qyJMny4z8jJz/HHWWrcdINOct0I7ZzkUkdq1XyPicpTxgGRHaJ:s6OjI8JzvFr5N7t0KGqAPi0xPUJ

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2