Extracted

• • Target

    Pirkuma pasūtījums_(PO980043)_CNC Baltic.exe

  • Size

    638KB

  • MD5

    119e26f5363c912425224601b8bf2755

  • SHA1

    44cf0f1a82b4109854924c0ab1c34fcb7b75235b

  • SHA256

    77f4283a7201b2325f301224b6977e69e340ae21b9221f31272e30e03522137a

  • SHA512

    26154db4369cd1bf563d46004a4cd9ca1ccee682482d02c43c51bdb0d3e6a40346b49a567be52495b92878be349df0d6cd6e23030e5482b1b445264263c78183

  • SSDEEP

    12288:2Kry2/qZXzmowxht2fxyIL1COZLv4wkZzE96Ghz1X0aiyIWA1X1j:Rry2uXzmH92fxjJCOvxsA96+a4A51j

  Score

  10^/10

  lokibotcollectiondiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2