Extracted

• • Target

    MalwareBazaar.7

  • Size

    668KB

  • MD5

    5cc4c28bcb6afcd6f0cbf9fe72e62905

  • SHA1

    a01adb1d5428cb9c8ed9204753d5769b815c1503

  • SHA256

    4f0243930267af37170243d384fc111b2ca3da9a3497cb7862485d7b62d71607

  • SHA512

    6849a43d9ad133b050ca5087bc94ced28e88c820e6303c3241a707052129a84344437ef324c5905de83e6f352492b4b565c2bc10c3a4f19229816d90a20a5c00

  • SSDEEP

    12288:bCc0RBN2iN/m2j1gQs5nx/FUkmPxYwlxFJHxj/14GBw:bCc0RBN1FjJgxrF7CxrxFJRx

  Score

  10^/10

  executionlokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2