Extracted

• • Target

    52bcfea0c53b74e2b84b54d5b9c5d4b3f214017063e3b3339bf95c84ab62f485.exe

  • Size

    606KB

  • MD5

    7f84fcf457a46b922d6a1b4c8773dc9d

  • SHA1

    cd08dc3047946777419a7ea00d82764061cf84ab

  • SHA256

    52bcfea0c53b74e2b84b54d5b9c5d4b3f214017063e3b3339bf95c84ab62f485

  • SHA512

    584777150643035a12e71e535d8479b7df87d4c8d31423bee97d517b6b770814ede6135e44fbb984bbe31dbcfd8e5b8b90592b5050c35c07e470bfbfd199db5e

  • SSDEEP

    12288:wJdXtfET4/Uh3WT5xJnNhlAAwfPZBDjEnV46lebHHgl6b2wwkR:od92r4T59Y3704AGngYb5

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2