Extracted

• • Target

    a7122fca4bb62f811710d0149828a2e542ef22f53124319d2f04eecd9abfbec8.exe

  • Size

    520KB

  • MD5

    9b9b9861c4bac5b3265f5f2093160ecc

  • SHA1

    1d0e49744c9d92e2e0ddef509603200a155d6fa9

  • SHA256

    a7122fca4bb62f811710d0149828a2e542ef22f53124319d2f04eecd9abfbec8

  • SHA512

    0f4b089a11cdd7e67b631e17956782bc4898da608e24bafd14d6eaaf8816f3bc2d3514b07cea3f5ce7e48e0df4a5963d967e440ee9b590ecf3a9d195f03e6dec

  • SSDEEP

    12288:1Kg8bQbna+2a0zP1Hm/ecJcXKLUdhUIu4G6kR:kIa+LVOXKIdhUW0

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2