Extracted

• • Target

    NMB Transaction Advice Slip.exe

  • Size

    517KB

  • MD5

    9e441defd7d4ab7e0245ee8a26498deb

  • SHA1

    33da2fbc93355088674e6090ced0fb128476c9c4

  • SHA256

    b145eca67fb85417b21ebc5c779953b0797c62c6b2c01a067f779ba0225d2ae5

  • SHA512

    8a5168eed2725ddd3773c690be4b1576eaec8565623b15da08c67f747c46cdbf98b38306ee152a58de6cbca3bd051080bf56d9e34cf974ef5448df0a1dd6f1b6

  • SSDEEP

    12288:SNxzRKAStqueqGQo/cN9NGxtm3J6Zw49i72lUFkR:MF+qfPQQcQxtm3kw4kE7

  Score

  10^/10

  discoveryexecutionlokibotcollectioncredential_accessspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2