Extracted

• • Target
    THÔNG BÁO HÀNG Ð_N Awb# 7758797443.exe
  • Size 582KB
  • SHA256 916bcc13070bdc9e8cd15c2acb8f260b233713bd9b907ca3d027011bd8f6dff0
  • MD5 0b90669de9a0e795e90eb5ae65c94e95
  • SHA1 5557786fd68277d26c9765219fc56b37bbb9af92
  • SHA512 14e799e785f7f74f6a47381e9ffab36d78f496857c93ef84bfb6b810617e9128738fbc7a4a664ac59c985632aaef5cb871e89fb3fa6f0846b0decf1fddb62496
  • SSDEEP 12288:s2iNbvIGc2PtMpX93ZlwyIX7JiM3NQq2mOW6xm+JrCGs1cYkR:s1FxFMptpQLJR3h2I61JRs1w
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2