Extracted

• • Target

    duka.doc

  • Size

    720KB

  • MD5

    76569c5b4afa68005a85dc89be17c202

  • SHA1

    faf59d22868e0a31e8a26487a3c698713a6098b1

  • SHA256

    c224aee225d2b4980133a3329d8c9b2100987cfaa12342dc745b8d74d669f3f9

  • SHA512

    1e9749e6ca3b9496710c2762c87a109c2f08bb9113c8ba938a3ff800a3d4e9699833c9eef397da880cf8846dd8bad1da8814a2bd35104707d67a7448791f5958

  • SSDEEP

    6144:VGuqGuqGuqGuqGuqGuqGuqGuqGuqGuqGuqGuqGuqGuqGuqGuqGuqGuqGuqGuqGuS:+

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2