Extracted

• • Target

    4785d17feedabdb54660fcda356392d29749d4fb8130667e68d48c75735f418a.exe

  • Size

    867KB

  • MD5

    1dc5f66bc079586ec34caa1539e9a3c1

  • SHA1

    da62edb620350c10918998b0cb2172b3733a8f5d

  • SHA256

    4785d17feedabdb54660fcda356392d29749d4fb8130667e68d48c75735f418a

  • SHA512

    66032b4d205d05d01f5ee87eccc53c65357003ee61c97677f8cf126e07829ce5b31cb4892f27a0de19498a03c3f22ad6b72e093261e4315fcd527fcd5c1a9fb3

  • SSDEEP

    24576:4HEN1Fdrt0ZpKjKQ5ROdq+CztpBbFsRwI:4SRrKaX5ROdq+0zsF

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2