Extracted

• • Target

    916bcc13070bdc9e8cd15c2acb8f260b233713bd9b907ca3d027011bd8f6dff0.exe

  • Size

    582KB

  • MD5

    0b90669de9a0e795e90eb5ae65c94e95

  • SHA1

    5557786fd68277d26c9765219fc56b37bbb9af92

  • SHA256

    916bcc13070bdc9e8cd15c2acb8f260b233713bd9b907ca3d027011bd8f6dff0

  • SHA512

    14e799e785f7f74f6a47381e9ffab36d78f496857c93ef84bfb6b810617e9128738fbc7a4a664ac59c985632aaef5cb871e89fb3fa6f0846b0decf1fddb62496

  • SSDEEP

    12288:s2iNbvIGc2PtMpX93ZlwyIX7JiM3NQq2mOW6xm+JrCGs1cYkR:s1FxFMptpQLJR3h2I61JRs1w

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2