Extracted

• • Target

    Shipment Airway Bill_pdf.exe

  • Size

    952KB

  • MD5

    7845714ca8d3eb551af3d4c1ec2f6bea

  • SHA1

    5d480b48325e52064796220914759318435ef67b

  • SHA256

    390368c05bb5a1ba8a2d7be792b92881491765b0e0625f8144a88449b30bdc99

  • SHA512

    a453ee951488107ba4448c6b805f8ccdb2a3eb73bae3b4c32e540eac4e3f0a063a9655e7ec4b4ddcb0a7185541785cd5b9d1f7bb29a5b21380ae6592098ed2a0

  • SSDEEP

    12288:PR/MXPsQjiTiCAeeJpWkjumgIvSQCutDEVFbtir4247AQrns/kCn+Auh2y4S:VQvrCXEucruic247nrns/J+Auh74S

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2