Extracted

• • Target

    Packing List,BL & Final Invoice.xls

  • Size

    367KB

  • MD5

    4afe5f193bbd9b656d67cafd0fd6d960

  • SHA1

    038909d0d08a77de28f7f75d61fa4419bf975a00

  • SHA256

    dee188a1e94375c2ca0b7f82bb3f2d12ccfebd302fdf7ce1b21a15ca3c2e55d2

  • SHA512

    967f22f3b72ad4ebde157fe0ba9337dace1cee5a5639eaab2487d7839e5b0d64057b72406eef3ecca99225aa89118e8e1c51d3622384ec7b452b06dc7f9028cd

  • SSDEEP

    6144:868TzqKnj5KO7ASrFHKzrK2cg7yRI7reRkbrrIxtLxIISHBWp7rMMnP+nIg3oBoH:cmaYO71FHKzrK2aI7SePrIxRxIISHBI+

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Abuses OpenXML format to download file from external location

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2