Extracted

• • Target

    Pictures specification.exe

  • Size

    436KB

  • MD5

    a6b25df92bf20d0accfacca0ceb6ff00

  • SHA1

    7f50a41ccaddb514fb49806e06e88bb79e518629

  • SHA256

    6ed8f3ea0e3b32509af38df9c4691eb45c4680cd6198cf1dcb837071ce8236cf

  • SHA512

    3388924f2a4d3901f484a12f5bb26ef7a75e2224e4281a79f1baf22599f205dd50204dd39be3a4b862d928f97e0d5ae9ce9ef6380edd751d51bf8e6f7f43573a

  • SSDEEP

    6144:LNEQkZ+rtNzcUsmcYd7/5Q/ge/9I8hspMIdWDrTY6SIQs:LNE1+rtN4UsmcRzIw2dMws

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops startup file

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2