Extracted

Extracted

• • Target

    logicalwayofgreatthingswhichcreatedwithgreatwayofgood.hta

  • Size

    130KB

  • MD5

    16e67de00d1302e9720892be8ab6a06c

  • SHA1

    8e8ee3df01c4fb6efd9a5289f48b9795c2483063

  • SHA256

    4145c6882b855cfbe79cbe9f9359260d503b0733ef6c901a9f62dd273568e662

  • SHA512

    fe6d68bc44f8b2243e1f02e77bf4c39c1ddfe4b2c0ccbf2051da7d10641d06b1da5756e1e89806c09cdad06ea9ca4074a18e98416ece919dbdda55e530a19b0a

  • SSDEEP

    96:Eam7B6DJU946WJU92EYDF/9MM9/y80636sJU956t7T:Ea2wDJGWJtEYpJqsJtRT

  Score

  10^/10

  defense_evasiondiscoveryexecutionlokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2