Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.6895.26796.exe

  • Size

    592KB

  • MD5

    1dacd6e77760417a8650c79610f22589

  • SHA1

    a11239f07a926a0b9b8e16f3abc852965ba0c62e

  • SHA256

    4ebdea4aa3734e9ebaea310b1a7fa600b5d9f3e489c61dbe7b3e2a3ab98d48c2

  • SHA512

    04cf28b2334d15675eeeb8c7486aa97011ba90f04bf62bccb2def301964de05f2d961a76904e9221cb643f9cbeab08542145d26699c37bea6854d2be9515b661

  • SSDEEP

    12288:20bRl+NivA8WCiXD2mzq+5+HfN7hxZ4rfuxUs2YupkEPkR:2Sl2xmiXimzPYF7hxKrfu76ip

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2