Extracted

• • Target

    abeeca1676f089cfcc80ad5126fe4849b701bf185aebb30ab96b7c89490a73b3.exe

  • Size

    735KB

  • MD5

    52b90d1eed8e25aeebdce06a38f093dc

  • SHA1

    7bbb45387c64ee4288d0d6996084dce62f1edbb3

  • SHA256

    abeeca1676f089cfcc80ad5126fe4849b701bf185aebb30ab96b7c89490a73b3

  • SHA512

    3cc6ad209526984d669fc38c8270368563650f3061d47703de4166a79c9ee11553076a1a3ab9e4d79ece93f5e17cd4afebc671642f5b86a591f89c7ff9e4de4c

  • SSDEEP

    12288:IcrNS33L10QdrX4tf4nZWGCLIsXqCevUVeq+pzsvv3C1ONYKdO9OUqFRjnhRNdAC:7NA3R5drX4R4Zu6CHVeq+OxNYaO9/Yrt

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2