Extracted

• • Target

    Új fertőző betegség.cmd.exe

  • Size

    550KB

  • MD5

    9646ebeebe5711415a3aa54fce21c1c9

  • SHA1

    cfc64b9ed39c8e591bed1eecab77b657aa9136d8

  • SHA256

    785d6428a26a8844b3ab8a93dc5a48223f0bb6a8d4e28565abdc3f96981ec5c6

  • SHA512

    4da31bd8d6a737c153cd1aa2fa1195ba2da7328b4f8fe249e65cad8c4ba4d6f7da823409c8d8922616ec0663d70038b9e0a33807d898d2e1121e5820843c5fbd

  • SSDEEP

    12288:R0RC419gnx+4kqFglRe/hYEhde5yN45dkQkR:R0RFOx+4kaglRahrLeyNikX

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2