Extracted

• • Target

    QUOTATION.docx.doc

  • Size

    16KB

  • MD5

    8cf5763fe122359455c73a0f9bd03c7b

  • SHA1

    9c59e9599cce6aa7b022e2238343c9893f281755

  • SHA256

    a7cc664fd3d5a4ee0171191c4be54a26aa9504bdf901dbcdbcde7f63450fb787

  • SHA512

    571ccba3c86ac994fe33de8acf454e7b67b4b914dc791c8a725f0bf4247befb324c77fbe56eb27b3102d677cdfe4b25c6c85f940f7e6e3b62f9b335e66d9de2b

  • SSDEEP

    384:IyXVd8FWss8PL8wi4OEwH8TIbE91r2fRwJYbvi6Zmnaa:IcVoz5P3DOqnYJ+avvZmnz

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Abuses OpenXML format to download file from external location

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2