Extracted

• • Target

    PAYMENT INV.exe

  • Size

    590KB

  • MD5

    983601521176ceddddf5fc6142e8dbbc

  • SHA1

    962c55c211bdec3aa08990207ff80db1a6142b54

  • SHA256

    2005a7d48cf7e946fd3687933dceb9b8a06e2235508b4cda4d2e63a558da12fb

  • SHA512

    64f2869481460821ff91bd0425b6d47b9ecc15a16cf24883c7bd50cda56879f182168c931a0a928144f370dabadb0f1e73420de3efc6a9f904fec2c56e6f7773

  • SSDEEP

    12288:qE5TvcnBI9m5Xq+xQhCE6sP20iyyJc+ou:qqcBI9m5JQhCq+ou

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2