Extracted

• • Target

    562f0bcc88b30a19f309f2cec7288ef29faa53d2b9d33a52f964f2e3b09324e5

  • Size

    556KB

  • MD5

    9e3578db5336e49facb772d30d844b6f

  • SHA1

    6afb36f273e2dce6ef512104c04b880337507fd7

  • SHA256

    562f0bcc88b30a19f309f2cec7288ef29faa53d2b9d33a52f964f2e3b09324e5

  • SHA512

    6f66a462a377dc9fa4c3fa6c8aa9f926237cec8a48fb2ec4edd468057f4f419d7d5e4156e71036702cb135a9ed540a340d1701ee41e7c6d8ff71e63419c440cd

  • SSDEEP

    12288:zij+2dbCawDKSpZMKR7IJK316ejb/mg3L6DLwuHDnORLy1kR:3gwmOZMw76ejb/71KDn8OI

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2