Extracted

• • Target

    2360bb0b42650f2feb47a0e988ccc3ea.exe

  • Size

    730KB

  • MD5

    2360bb0b42650f2feb47a0e988ccc3ea

  • SHA1

    0712817e7fabe68e34d67ce4151728d9f2eb8cba

  • SHA256

    5156add523f08eb7eabb51f3ce648d6f93c646bec4c6cee7dd59d95e5b50b2b3

  • SHA512

    d95afaa69795cfa63bed2e22f98bc37eca17402c92a83f062b04b5883ac1cd5be49b6e5653dc8d0e6fb7127e573397ca62f518045795536912526ec4bfd9744d

  • SSDEEP

    12288:AcrNS33L10QdrX6O1nbGnBoX0DWdl3oV52aA8buKO01+0SOP1HvMKhv5KVwCaU0F:jNA3R5drX31bFXOul4qr8bK04BOP1Hvb

  Score

  10^/10

  discoverylokibotcollectioncredential_accessspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2