Extracted

Extracted

• • Target

    5c7f1d6ac7671a1b1764dba808cf52f5c5c48ce1cbd0f1c16d8f6cf0afe5d3c8.hta

  • Size

    178KB

  • MD5

    43f15554d66e784d988aa2da3ed2a136

  • SHA1

    6d0fb362a8aa62a046e25435e6a525e2ca61492d

  • SHA256

    5c7f1d6ac7671a1b1764dba808cf52f5c5c48ce1cbd0f1c16d8f6cf0afe5d3c8

  • SHA512

    2c06f6a513bd10d648dfec384fc1056b0e8f39a830e0671f9098961076de61ac7db5e0dc7724a7ffd403a4769b90324aeb785d0b16c13dfe7dd24342a9460cd9

  • SSDEEP

    96:4vCl17J1YiZVGTVy1YiZQGTVMFxfwVXNewJrC1YiZo1YiZDjGTVs1YiZkQ:4vCldfhjGTOheGTqHwShohxjGTYhuQ

  Score

  10^/10

  defense_evasiondiscoveryexecutionlokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2