Extracted

• • Target
    d4c86776bcf1dc4ffd2f51538f3e342216314b76cdba2c2864193350654a9aca.exe
  • Size 506KB
  • SHA256 d4c86776bcf1dc4ffd2f51538f3e342216314b76cdba2c2864193350654a9aca
  • MD5 759dd13715bc424308f1d0032ac4b502
  • SHA1 03347c96c50c140192e8df70260d732bea301ebc
  • SHA512 4197992f4b44ea45c91cb00c7308949560ae24d179e9a14ebc4efb27e1b20abae203b1c8756c211eb9aab9732a3fd04c824bd6bc92510c8de3caea3a8cfa8e55
  • SSDEEP 12288:5Qoo7mJW/tmZtHkO43UhcmxPHq4eOnW3Gtl9yZyfXdfd:5zo7mEVmZtHk+cCPqRWtl9KeNfd
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2