Extracted

• • Target

    e3af6c468399c93bcbd34979268ec84d752f3ca60bf2c942bf7c1970e2010a63

  • Size

    181KB

  • MD5

    6c262e93111d7fb9dbd93d6cf3259349

  • SHA1

    b493b340f84c21614887021b9cae8323aef47b93

  • SHA256

    e3af6c468399c93bcbd34979268ec84d752f3ca60bf2c942bf7c1970e2010a63

  • SHA512

    d86b34febd835d036de7bbef4c37b55955fcdccb19ce2bb9d437e544bc4e83aa2945b1f0f086c96d7370923f9f25bfcc8e6025e1fb8711081023e30c68e351dd

  • SSDEEP

    3072:J1E/rS2paccKntce45gsUiraIwfA6s46UI9xcPfJHZ851gnFrq2DDUs1L:J1onnFBiyf36UQCq+Us1L

  Score

  10^/10

  lokibotcollectiondiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    3f176d1ee13b0d7d6bd92e1c7a0b9bae

  • SHA1

    fe582246792774c2c9dd15639ffa0aca90d6fd0b

  • SHA256

    fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

  • SHA512

    0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

  • SSDEEP

    192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn

  Score

  3^/10

  discovery
  behavioral3behavioral4