Extracted

• • Target
    Fizetési megbízás.tar
  • Size 522KB
  • SHA256 4298ea880ee6c352e0ca6c25cc7737a5c92ae24d565f1cd5402770f7e6f2faba
  • MD5 ab7cf9a2889148e243dc3acd3429dbd4
  • SHA1 f0da693d8d5bf073fa5765352f59460ee41c7bae
  • SHA512 14e8503340208c918fcbf20590ac0de5e7670af674d75531f4acad2aee8989f98b0576030b7b1813b8f2b14018ca8b02c5a759e6bc71d83e77940e7ee9c96397
  • SSDEEP 12288:l0rLRtTNaLFoQrE2VmXuMJCVFzpc+8sDtP5EUkqc+b/iYJ4EjDNMN+k:uxtBa9mX8VDRD9V+i/HNS9
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral1behavioral2
• • Target
    Fizetési megbízás.cmd
  • Size 604KB
  • SHA256 238756523f89b0c8cafd1799604249d2533f01cd4865d9f6cf6e4d0db38037ab
  • MD5 6792e47100b410eb683ed5e32ff54419
  • SHA1 e4af127195cc052a45c1061c2da91051e94a07ec
  • SHA512 bd63a0d4a9b88db5205083b323f79c1bf6b3e0b055b88100e2c57ab9dd228a64832104b9116c4e045c89ad54d0f5a29f191954ac6da40eaaa034c0b43077beed
  • SSDEEP 12288:4GZKzv9t2E8ZRlTZCu01qc7bHl3031SO0kPu/BqGulNpMBKYvI8hFUMkR:ytzMauuz53O9BPu/B5ulNaOAFU7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral3behavioral4