Extracted

• • Target

    0231694f46147aa9abe3f17a27ab2568d07a842204c67b13b57fdf155ef48440.exe

  • Size

    512KB

  • MD5

    86e9839d0cf42159b2170592c24c353a

  • SHA1

    f10792e838d62d347b8671e62c440af687bda866

  • SHA256

    0231694f46147aa9abe3f17a27ab2568d07a842204c67b13b57fdf155ef48440

  • SHA512

    def837359516f64b4f68b58cc0e466b28432ae63e8ca06854c50174d0dee5a7c3f97d2e3e9c68d95d498c506a4768e04c3d62e062b40f81340adebd1597daeb3

  • SSDEEP

    12288:lbnYtk5EGaHfSX+q00YXj45QJrsh/8RjUwwVjDsm8bQbjkR:lYfSX+q0vT45QJ5RtwVvsVI2

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2