Extracted

• • Target

    Scan 94K USD.doc

  • Size

    360KB

  • MD5

    39990481e7a4ebc5ee5b30b8f9ecb44b

  • SHA1

    48d884a85d9ef84e8726a8c825f0722878ab75d1

  • SHA256

    ac4e5f6f39aebb0f686813bd7ef6b678050d0876f05bd6f30aaf7d08f2d0d7d7

  • SHA512

    1c231dd4947d81b64e7e4dd526addc7d568b7e1b5049b41138073a38585c1a2cc0c54e88d4c5c40483bd29261169299e8552f3651c3e43fda98fafef0410f10c

  • SSDEEP

    6144:FwAYwAYwAYwAYwAYwAYwAYwAYwAYwAPIwL:uv

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2