Extracted

• • Target

    e76d55b456c40a2cabd8a4fc1e261deaf73b50683d9e06527cf4cd7321570a2eN

  • Size

    547KB

  • MD5

    ec26d777a5eae8ea6fe66f8ce930d5a0

  • SHA1

    a9f849f2a5248e46cbbb05169367c31923d7e704

  • SHA256

    e76d55b456c40a2cabd8a4fc1e261deaf73b50683d9e06527cf4cd7321570a2e

  • SHA512

    288a17bdef3e517d1cb6e27c14fd281e4b0c5805dfe91c1e333b7dd5aee9fc049a71409db2b96ae684027b12ed113a2b38ac9969acdb3651fb7a65715d4b42e4

  • SSDEEP

    12288:/YV6MorX7qzuC3QHO9FQVHPF51jgc54TfIbtm/2XjnCBLfxkK:MBXu9HGaVH56o42zRK

  Score

  10^/10

  discoveryupxlokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2