Extracted

• • Target
    Bnnebgers.vbs
  • Size 70KB
  • SHA256 b39688815505416bd3ce779da8714b4eb492dea27036998ad90ddc439b8d554f
  • MD5 5b6ded9dd4c8b33c96ec2dfccc4185ba
  • SHA1 baf00d33cc29a38cedd43d1b483a24e5af5ef707
  • SHA512 aeb3c167595408bb06a89a18c48fa4f097c5f4ad22b1fe0a8ddbb120d7b4b57939789a5b5427fdb3fe781c0bed78589bc618b724c0a73345aa502eb93c611b57
  • SSDEEP 1536:susq1DWeDHqjpgA5JePv0wXvLr+s3NyQr0AyG1XLatJkYf:susq1qeZAHeP2s3BYU1Xqf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2