Extracted

• • Target

    2c2a57b3a137d49c53bf35a36a7136a78d67fcaa16b8f352a6b46a457d691815.vbs

  • Size

    77KB

  • MD5

    34273527e12e172917598d0e29994432

  • SHA1

    d390fd4b4ffc45be0a7cf05765af19e402377640

  • SHA256

    2c2a57b3a137d49c53bf35a36a7136a78d67fcaa16b8f352a6b46a457d691815

  • SHA512

    b9693348f7ddc2564c7a1ce748e58b080c73e57a85ae8f3b673d60106be4c967708c035ca2a820b7470a2be7642592c2db6c14ec9cccd0849eb153f8caebb6f9

  • SSDEEP

    1536:sI0FsAXA4vqGxAx9bBuQPOyk+4OU8vL0yUbVBwXYf:sIcpPAPbB4OFQyIf

  Score

  10^/10

  lokibotcollectiondiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2