Extracted

• • Target

    Revised PO#81223 , PDF.exe

  • Size

    313KB

  • MD5

    973007d44df8a46739d13b6946b05495

  • SHA1

    dc916bd9de4c19fc353d5efb3113afea0deb6b92

  • SHA256

    43f445c8c772ea30a95c69331da3113f550ad3b3e5d5b6d234d8fd8457b38d16

  • SHA512

    456de8d86ea0064318d8c4d0eb70b7614520672ad86dbf0f37891ed9dc458c9623b59edc5cfeaf0fe2066ddde2ac50f12ea21b834a497e44fd6e3fa26c683d3f

  • SSDEEP

    6144:CFXuNXQQW6LJS5dVNK+4kGzA2WI7NQyJS1LRXXn2b5847:qu66LJSpNNW9WI7GLRXX2n

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2