Extracted

• • Target

    589026de83790db3912fbb7c0e8b2da67d24503452a5c20c001e24c4950bd9db.exe

  • Size

    545KB

  • MD5

    f534eca6bca33bf5865003b0ee44fed3

  • SHA1

    3c82af992b1bbfe27e63e80fbaf9ae5a7fb2e2b0

  • SHA256

    589026de83790db3912fbb7c0e8b2da67d24503452a5c20c001e24c4950bd9db

  • SHA512

    4aed724ef00804d6b35e9706dd1b454879c45400ffe193f0c9c2b0d6020c508ed02c468edf48b3accbeb6b442366093a6105ea51cf1e0aa6cbf895d8bab18270

  • SSDEEP

    12288:VVVkSNuUDYgGsJ+OlUIsNbpPPvxmf8tEKz7JYkR:BkCuUDYMJ1+IQPhaoP

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2