Extracted

Extracted

• • Target

    ec97b59bc0398eb50eb842046e017755dbbc8d6764a6c26db85cd90853760669.hta

  • Size

    178KB

  • MD5

    5476ba599869d81abee08f38f1c1a1d9

  • SHA1

    46748779ec123145fdf90942c9df65d0099c9a99

  • SHA256

    ec97b59bc0398eb50eb842046e017755dbbc8d6764a6c26db85cd90853760669

  • SHA512

    516531534bee5995295659464f480c6d12909668fdb623c0c02dd93c9055df7bb203833e4e84416b31ef923dff8057f76f0e850bb84c53096cac43cdf2d04edd

  • SSDEEP

    96:4vCl172Xu01IhxXYcQu01IhPXYZxd7b2+sMdHeu01IhLu01Ih5XY4u01Iht5Q:4vCldarG1QrGsx92+KrGLrGZrGLQ

  Score

  10^/10

  defense_evasiondiscoveryexecutionlokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2