Extracted

• • Target

    c19b70dbb4f6b4c1d33175598d82df4fd0798955a6c26a3d5f787cfc5566734c.exe

  • Size

    549KB

  • MD5

    8842ebb96a902d9dc28296d45abbbf53

  • SHA1

    4a1a850f093f2f97a7afabe0a8bdb33fed886fc8

  • SHA256

    c19b70dbb4f6b4c1d33175598d82df4fd0798955a6c26a3d5f787cfc5566734c

  • SHA512

    7e38b1a428d637d16c8279f17e2a13723d7b5a888cb038505e9e0956c060a31923f7533f9547743da89e6ba676b1874f13920f86968af94518c2de522d9f2b9b

  • SSDEEP

    12288:hWx2PQf4yXNhszFwUBpfKC0+FC/DJMIcCEyIHgxBVb5bKvYqkR:8wMbNGzFwUBpfM+ElMD1MdbW2

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2