Extracted

• • Target

    seemybestbeautifulgirlwhowantbestthignsenitrelifetimethingstobe.hta

  • Size

    178KB

  • MD5

    51ff32b18625da8e57f2b01773842cfe

  • SHA1

    5a67dd2a7f6e75324129678af99b09936bc5e2e9

  • SHA256

    b32a47004e6134879604cb3246c89b351bc5fb2547b1d87070846c5719951727

  • SHA512

    6ae49faacd42c43f288560d3cc77929e7b5465a522bdff6838df5d8f7ebc9228091e2279e9e63c008456e3c467033188a0e68234a38e8016c994b3c5eb1c8d6a

  • SSDEEP

    96:4vCl17nf2iLZ62iLqG4SPwYNf6hzhs2iL0Y5Q:4vCldnf2iLZ62iLISWs2iL0Y5Q

  Score

  10^/10

  lokibotcollectiondefense_evasiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2