Extracted

Extracted

• • Target

    3b5f33baf9dbcbe033909735e6238ecf8c3f5aaf915d7298157fb07e034cf2bb.hta

  • Size

    206KB

  • MD5

    ee06f92a6abcd0b214c3251740547dbe

  • SHA1

    6c36d8fa208e1c6f97272ab9f14b4e6b1ff17f3b

  • SHA256

    3b5f33baf9dbcbe033909735e6238ecf8c3f5aaf915d7298157fb07e034cf2bb

  • SHA512

    8d198174ebef3ad98944261cff5eafa079557ca5fda0bfdd340d193eba49e306707f331586bf321ebdb401d40df645de0f411dd1d6592854c3730f3fdf54088b

  • SSDEEP

    48:4FhWsTR/F7gNqXfgaEJK4RJcB458p2ybuzkyq88oCxL/RNOeugGr4BJSFJkvhNcm:43F97/E1RXqfbutqSCxL/Rgeb4Frh/Q

  Score

  10^/10

  defense_evasiondiscoveryexecutionlokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2