Extracted

• • Target

    425ef5b31a93a014e2ff74d66c148a7b73b0fb2a57ab2e015576cb2272db5dfb.doc

  • Size

    16KB

  • MD5

    58fa856ae520dc6c6e47f4b459e2de5b

  • SHA1

    89c76a3bcb6a83cb1b343f5ea03cfc2da2214e97

  • SHA256

    425ef5b31a93a014e2ff74d66c148a7b73b0fb2a57ab2e015576cb2272db5dfb

  • SHA512

    9f7f17693948a76f679bc076464e4c71408a3dc6a31b14861eed0fe987032ef9a1402c34ab8905aa31d3e373c4f50ac5148a121ca3e4498cb7fd31786318acd3

  • SSDEEP

    384:IyXnXK3Wgs8PL8wi4OEwH8TIbE91r2fRcJYzviML2nkPt:Icnyb5P3DOqnYJamvtL2nkF

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Abuses OpenXML format to download file from external location

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2