Extracted

• • Target

    00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe

  • Size

    1.1MB

  • MD5

    da2dd76b31a45ea2b9f54e9a7ff22f79

  • SHA1

    d674ed49f4be14b16abe7b71b96927288740309e

  • SHA256

    00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974

  • SHA512

    c5f25453068d7bff4af855873b59b95db69dc456d9a38c5cddba07eb95c9a2a58d98bb391d823cc9b41c8aaae15234a2baac642202c44a96c41c7683ede89178

  • SSDEEP

    24576:oqDEvCTbMWu7rQYlBQcBiT6rprG8aLF/IcUuJ94fdFc:oTvC/MTQYxsWR7aLFRUuiF

  Score

  10^/10

  discoverylokibotcollectioncredential_accessspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2