Extracted

• • Target

    b2059d6bde8d6af8476a968a13f14486edf3c905495a36cd963dc9765c40863a.exe

  • Size

    867KB

  • MD5

    9e563eff473f135bb745d111006aa96b

  • SHA1

    18b34df821644267e39f7bec4f71c11f72703dad

  • SHA256

    b2059d6bde8d6af8476a968a13f14486edf3c905495a36cd963dc9765c40863a

  • SHA512

    e122ffcc5109e2d0640ccd73b09d29820295f2ca6f094955056cb5d8a2079660b5dc762cbcdfac3deb9761642c796bf8e9d704d2c85b8d9d996352be15b2ed6b

  • SSDEEP

    12288:0NYa2DndPYCRlHEHoJP1+NBSoqoOKVck0FgRry24s7aAAT3YRaAWDmyp2aU7tUHu:0NezHRl7PD31KykZR+sATIRYI

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2