Extracted

• • Target

    4ebeb928e56c30dc2fa722e5ae1e41181bfae00ce0466226bcb7d17a7dbaaae7.exe

  • Size

    551KB

  • MD5

    148edb6ca3c6cae9047ad33eff160ba8

  • SHA1

    ac90b0e8c2565e0fdf4d6657bb75ca7971ce3503

  • SHA256

    4ebeb928e56c30dc2fa722e5ae1e41181bfae00ce0466226bcb7d17a7dbaaae7

  • SHA512

    8c51aa8f3f5d051eed69bb20464f749968d70cc5420ed6329262579e60dceed8a83f0ad2d2156e4a93f70ef6df1a7dd3f99eaa7585a8d8502cfd25826040f273

  • SSDEEP

    12288:wmoL3rlW4bKUDHrjOYMxs/u5XcULGBCBa51HrC80CQKkR:ovZrH5ysG5XTKCByWGA

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2