Extracted

Extracted

• • Target

    greatthingsalwayshappeningwithgreatattitudewithgoodnews.hta

  • Size

    131KB

  • MD5

    cbb8dddfef9d1d2893d4a4b51b4f0dab

  • SHA1

    595c2221b9613342ed4a82c235ea19fe9c0383f9

  • SHA256

    e25677838f8394ed8b59c431e454e3bd0ec107421ef1a2502c5167bdd1340ddc

  • SHA512

    1daa9c96c9ba2e6e1939ab2b82e9a8f771f9ba0d4c4d088214864034aa9084483c1f42e5436f32043809a0346f0d59d84eb902946e6f1672175e22cac042d4a4

  • SSDEEP

    192:4vCFXMFgYPCgYmHUCYc6dEMoyzsDxgYtaXQ:0CF8qYPRYmHU1Jyh2saYtag

  Score

  10^/10

  defense_evasiondiscoveryexecutionlokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2