Extracted

Extracted

• • Target

    greatwayforbestthignswithwhonotwanttodo.hta

  • Size

    130KB

  • MD5

    67a5ad5e7caf5c79cb209e433c345c0b

  • SHA1

    15776cf58dee4ecb7b42b2836539d8d553bf5439

  • SHA256

    5d06cbde318e42ef7e39a6af52d96576aec4f11477101e4c90718f12c09c5eb4

  • SHA512

    b6b697d11dca698441116526bad13c366ba78b477b7489372fff4155a3a06fc49a6487cf2e7a6e33855b7ac7c57dc0c99760a6fe54e77f2b2ec51539a6f5ee96

  • SSDEEP

    192:Ea2xJKbBKWvKbBRWGWiJnKbBxKbBDWNTKbBUT:UWSHWi0yW22

  Score

  10^/10

  defense_evasiondiscoveryexecutionlokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2