Extracted

• • Target
    file.exe
  • Size 597KB
  • SHA256 c6134dc8d4cb365309ce031501eb322ab4d4731465bd7e1fb75421ac7f2c6734
  • MD5 db19845d99d3dd9e60dcfdf810b9ce45
  • SHA1 401bfd7063515b6eeec60a97d84939d0dc087bc6
  • SHA512 429aa2bfb4fab09ad40bb0a6200c59b873810c2df0b8f986fd81501ea4c1c03581e29dedb7c2a0590c77e1cd247e290d74f7f87d26d8db6b54e0b39cc8035805
  • SSDEEP 6144:xTDErFMmH8Sj3fzzQxFajJ162x7NBYvDbG/hrsBspChm51aop1t+uqmSR/KIg4pc:Ju/jvIGc2tN7h1F7LMK2pzactbs6kR
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2