Extracted

• • Target

    ca863343ef83e7233296780f9b43b17aaae114dfa1b418e0a45d0649cdb2fba4.exe

  • Size

    597KB

  • MD5

    ef2f151c1cef2bb8b29efdf21f24bb4a

  • SHA1

    85c8503690651edec3919a77bac30df4b42a4bbd

  • SHA256

    ca863343ef83e7233296780f9b43b17aaae114dfa1b418e0a45d0649cdb2fba4

  • SHA512

    c922668fbb8b7c6cb0170f40c9f75776cf5fa92cc10eb2585182849c6a71a1acc29e79e1332ebbb97b3c0dd20a64e8e7d86d5586974a25062d3c9b64a3285046

  • SSDEEP

    12288:k83cOuibXW9DVcq3KB5v60cPrpcYkThzU6mRBwloL3rlW4avkR:kfOuoW9eq3KBZNqN9kThz0RKyv/

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2