Extracted

• • Target

    759dd13715bc424308f1d0032ac4b502.exe

  • Size

    506KB

  • MD5

    759dd13715bc424308f1d0032ac4b502

  • SHA1

    03347c96c50c140192e8df70260d732bea301ebc

  • SHA256

    d4c86776bcf1dc4ffd2f51538f3e342216314b76cdba2c2864193350654a9aca

  • SHA512

    4197992f4b44ea45c91cb00c7308949560ae24d179e9a14ebc4efb27e1b20abae203b1c8756c211eb9aab9732a3fd04c824bd6bc92510c8de3caea3a8cfa8e55

  • SSDEEP

    12288:5Qoo7mJW/tmZtHkO43UhcmxPHq4eOnW3Gtl9yZyfXdfd:5zo7mEVmZtHk+cCPqRWtl9KeNfd

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2