Extracted

• • Target

    11f9aa994a349d0b21caacb75e8b7198f1f52828628efd891aa7116b261e2182.hta

  • Size

    178KB

  • MD5

    e80a6dc30c45134e8c433ef07277022f

  • SHA1

    9041ab7b0cf03e4c18f86ff32eac95c3ad06f462

  • SHA256

    11f9aa994a349d0b21caacb75e8b7198f1f52828628efd891aa7116b261e2182

  • SHA512

    6156f6fcb24fedaabb7d1d62a0ff71e7bd8c6ab194c1a5c1b7ccc25644ba36dd62a79a8989dba98015044502a64db5c32187b802cc42dc964f25323c352519d8

  • SSDEEP

    96:4vCl17nlkfktbLVe4I9qWs5cew1WyNk6O5Q:4vCldn+s9he4CqWj26O5Q

  Score

  10^/10

  lokibotcollectiondefense_evasiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2