Extracted

• • Target

    b62421cf478a292a99e3d253a7c36ad616ee06c83bada7b0b34a6365302acb69.exe

  • Size

    563KB

  • MD5

    f8bba91bcd6d19f645154899b4ae3125

  • SHA1

    868391d550705f15fde3a4b68a0d82e49522017c

  • SHA256

    b62421cf478a292a99e3d253a7c36ad616ee06c83bada7b0b34a6365302acb69

  • SHA512

    7d8f0fbfe5059348138a1d2fe94f1f93fba7b4dc6c9752d94eeb1a64356b72500d0bd19a1c8641939a12aa90a429a82636ea935ea9a3cd398f91daed86703b8f

  • SSDEEP

    12288:EWroL3rlW4bctETORCOO7VkZ5iUSenNflbjVhBaaUmB996kR:OvPHTO0r7VkZEU/NP7UA99Z

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2