Extracted

• • Target
    Fizetési megbízás.cmd
  • Size 604KB
  • SHA256 238756523f89b0c8cafd1799604249d2533f01cd4865d9f6cf6e4d0db38037ab
  • MD5 6792e47100b410eb683ed5e32ff54419
  • SHA1 e4af127195cc052a45c1061c2da91051e94a07ec
  • SHA512 bd63a0d4a9b88db5205083b323f79c1bf6b3e0b055b88100e2c57ab9dd228a64832104b9116c4e045c89ad54d0f5a29f191954ac6da40eaaa034c0b43077beed
  • SSDEEP 12288:4GZKzv9t2E8ZRlTZCu01qc7bHl3031SO0kPu/BqGulNpMBKYvI8hFUMkR:ytzMauuz53O9BPu/B5ulNaOAFU7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2