Extracted

• • Target

    889TeK5yVN72YbS.exe

  • Size

    519KB

  • MD5

    a82fe3286628c18a13d7101cf4ad9fa5

  • SHA1

    2431dcb0b3e8ee2c9c2e83ba97b60e2b436c8080

  • SHA256

    9c0ca340482798d9a62a26b8928e2bfcc20aee978a6b948d17d4a2c04c9adb0a

  • SHA512

    8fa386a25453469259fa9194c02530686e4087a58a22a5d7035826dcc15a70cd3c0aa0c68396f47c239f25ac915213c5df65ca5cb69776c61c596be54ef6840c

  • SSDEEP

    12288:B/iPhHqAkqf6tze5DwtZKFpUpXYD/YSqiAIPwURZM3/u8aj8g:qhKaf6tzfZ+zc

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2