Extracted

• • Target

    PRORAUNSKAZAHTEVA09302024pdf.vbe

  • Size

    73KB

  • MD5

    ae06697b71084618bb9a2d051f6fad2f

  • SHA1

    d3cc11739d47aebc183e425750d53ea0d412c8e0

  • SHA256

    dc6607f4aa63d04407994442f3f085ccd29a2feadac2a791b90cdbcfee2f5fac

  • SHA512

    ea85577950701655694c970ac44a9f80ccca80f59166d0955d946570493b374f364c9fafefd548af04b8d5ebb6d494be64b840fdb55df00070b84bd4ef5dff34

  • SSDEEP

    1536:sM0x6oY5kcFA/RYq0KkFV8N+FhhxGEoU5J/Gbrf:sM0xlYAJYJFFhhFo9f

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2