Extracted

• • Target

    MV Medi Aero IMO NO 9708966 00877 -xlxs.exe

  • Size

    434KB

  • MD5

    fe42b52214d984619bf7c42d73bc7980

  • SHA1

    4dd5052bbfcb6d37a636decae1d8bc03f5c355a7

  • SHA256

    98a050f19567bb930538a9656904f62036a9bee4f3f08c24463d6777cd87eabf

  • SHA512

    1f1ddf27221adff8884c239c85c35e8c1d2a0acefe7569bb4a1f7fa1815e37c095b5108a4fed08f465a99e593eaa8d0883af2946c4f531a57d5203f5ccc296d6

  • SSDEEP

    12288:sYKYjP6eP97rBuR0IXXp2ExYu3fOzVaoXXl8EkZO:d3jP6+7ronpJr3fQVNn

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2