Extracted

• • Target

    MalwareBazaar.0

  • Size

    584KB

  • MD5

    41c7bccf13d6a63c3ab0846b8c0b0ffa

  • SHA1

    2305ddcf8cebf5ac8bbdb040e94572844bcf1b96

  • SHA256

    9ca4491594bed34f77e581987fb61a0085c1311d94b8118bee73b4f08710da5c

  • SHA512

    afb79a477f12de373846a8c01a85b61b8569cf916f408a5712972bd8ce2026e1946c9aa63f6ec2b12192bb0dfc49399a4ed5b1cbed3590ba1d38b3f1a59003e6

  • SSDEEP

    12288:9VW90xC05r5ZDEg01nZI+3SqFD+Pe7Fly8vIHPHQEuvi:X+ECKZDEg01nZDScD+Pk/y8W4q

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2