Extracted

Extracted

• • Target

    seethebestthingstobegoodwithhislifebestthigns.hta

  • Size

    130KB

  • MD5

    0b1aa8ae190d05df71f4052fae67df5b

  • SHA1

    f6fe29f3e7830b15e3b244ba83216c029dcb60fb

  • SHA256

    4e15eab180712f99efe5eea760beea458c7bfc4eeb5f5961b2b5d0c9b7611d3d

  • SHA512

    94008a8bf00a1334c16129258243bf89d8351c82ede845fefdb657838fe2f602f761b9935e5fef5e01b368096993f49a48e65d3705cea948d9435db0df370a04

  • SSDEEP

    96:Eam7QSo4DH5wo4DH5rtTRJP4srvjTKP4DH5Sr4DH5NFAb5UAf4DH5G7T:Ea2Rok0RLknYoVT

  Score

  10^/10

  defense_evasiondiscoveryexecutionlokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2