Extracted

• • Target
    35CB32A55A35E40C9B1654A7CAEBBBBD.exe
  • Size 553KB
  • SHA256 71692b3424831986e4a395c5fd48862a658d12fc82cd4d952de96ea03c577eec
  • MD5 35cb32a55a35e40c9b1654a7caebbbbd
  • SHA1 9ede04eb8d4709d556db7ab5910365dd96ba0df0
  • SHA512 06a82a4da576082c32f377345b60652d925be8cc21bbb5d4bd864f8e7620fcfaa14376f8b39d95f441b3da00db39a21f6f4f0517644463c0f752442eeeab9d66
  • SSDEEP 12288:mqzjLf30WH0t9l5nRjynAV/lypfpKmD3Y4A/Iu2IOigIaUQJKRy/ikR:mEjj0yKzn7Ec8U2VkqKIp
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2