Extracted

• • Target

    scan.doc768998.exe

  • Size

    429KB

  • MD5

    a68cf22105918f7cddb0a60a3180e300

  • SHA1

    b0b6314bd1959ac5b7931f0f0595bd9e57eef0b2

  • SHA256

    0fab5cb2a6325cb94875317856ea62083fe303c051460ad0ae6914fcba4bd7e5

  • SHA512

    8365d2597478c359ba07ce1f6e2e5d68d595370135e4403204351fd6cbcc2f4d3fc596185467aab0eaf26b74b7514ea77eb9c850c6ff553bef77898286de1163

  • SSDEEP

    6144:UuEvktmbNyan7fU8prYN9FLCTbqpQ+XWAHNTtD8ONyMUNjiCXKqcWrfSiUYEm:5tm57BRTbqpTWAHNTtD8OeIgXXqiUYE

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2