Extracted

• • Target

    DB9KJ06B1.exe

  • Size

    692KB

  • MD5

    f546c5045d223d52d10a11da4a9cf625

  • SHA1

    fb66509226ffdb1885770151dd6b19ecaafda5ad

  • SHA256

    75cc1ed940e44793e1ed307aef46b6f36eff0d69c70356c21b264caffedda4e9

  • SHA512

    5c2f8fc55e59b735173faf3178000ef7107da797b6fb9cc376fa1830067fe5d2f2606a5a19b6ec42f12614294eed0201e065913d11a6fb7954b187314d14edce

  • SSDEEP

    12288:78E8rixlaIH2qwgSUopK4kAC43a+f6fXmWOHsOuNicMJQckdmmdbcQTwnSkR:77fxlaIGgVQ1CxR2WOHsOuFxm8wnh

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2