Extracted

• • Target

    MalwareBazaar.1

  • Size

    583KB

  • MD5

    e44f18c0c7c0ef5103adb70ea9797794

  • SHA1

    e96882549e5ca1bc3cbedf276a3b0dc2e74b7c1c

  • SHA256

    ce03ff47b601e4154e103927e9b8e9f9f54f18653fe4bebf0a25f6458009dc0d

  • SHA512

    3facc779735f5132569dd413191add13333a28d476c9adf3119773af3f6f5a36f1a5a1f768bb2c40c563c10c6574a4556a97755ec36eacb8e5d471341a067277

  • SSDEEP

    12288:LsHzOUNUSB/o5LsI1uwajJ5yvv1l2WmynaFDoml:6iUmSB/o5d1ubcvnA5oo

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryexecutionspywarestealertrojanupx

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook profiles

    collection

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2