Extracted

• • Target

    35CB32A55A35E40C9B1654A7CAEBBBBD.exe

  • Size

    553KB

  • MD5

    35cb32a55a35e40c9b1654a7caebbbbd

  • SHA1

    9ede04eb8d4709d556db7ab5910365dd96ba0df0

  • SHA256

    71692b3424831986e4a395c5fd48862a658d12fc82cd4d952de96ea03c577eec

  • SHA512

    06a82a4da576082c32f377345b60652d925be8cc21bbb5d4bd864f8e7620fcfaa14376f8b39d95f441b3da00db39a21f6f4f0517644463c0f752442eeeab9d66

  • SSDEEP

    12288:mqzjLf30WH0t9l5nRjynAV/lypfpKmD3Y4A/Iu2IOigIaUQJKRy/ikR:mEjj0yKzn7Ec8U2VkqKIp

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2