Extracted

• • Target

    knRWhbakTycqG0L.exe

  • Size

    314KB

  • MD5

    c52d92fadb274e3b90d79145a38315d8

  • SHA1

    5d90c8e69cc7f42bac6795c7fb6d218aa016b142

  • SHA256

    0da0e7ed05790977b34ede6cd1b441e56be702b14c7705a3e72a22d12b479a32

  • SHA512

    3b4b4c071ca7ed9c8c751ce778036076fa905a849a24b3630e49a7c0063a4d640c499a4d6f125525be99d16bcc5c9985f79a6819acad2304df05ae744d5a66bf

  • SSDEEP

    6144:60clODFj6i2s7RR+KoGjSKiX304yXxN2Sn4EcmZHyXFaxmVmie9bngPbW69v:XlDl6PAD4Vn04UOSn4EcmZHAFaxmVmiH

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2