Extracted

• • Target

    002eb261ac533e6ec256236996b229688b08f56aa143f2b2a257c215bfba0195.xls

  • Size

    1.2MB

  • MD5

    c4de8d19dd2ca3d7dbe8bef7df57cbec

  • SHA1

    61337281c5dd8dc3586e8286e38ebdb27126b0a7

  • SHA256

    002eb261ac533e6ec256236996b229688b08f56aa143f2b2a257c215bfba0195

  • SHA512

    d2b502172f3fa2fe1102c6fbca9a9e23e0ad3946e65a0e0d3309f51ae252969097f5256d20080a865fb9142840f3a20fdd5fcd4984b030f8a90a225bdd20e174

  • SSDEEP

    24576:Cj+sS5ylM7RPQH/9A20bh6XwItW9PS9dfbHVUlrkwCIGwD:Cj+Zsyk/u2ukW09dfZoRfGwD

  Score

  10^/10

  lokibotcollectiondefense_evasiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2