Extracted

• • Target

    GT98765678000800.pif.exe

  • Size

    461KB

  • MD5

    fdfbbc8edd70b51d54176815b77d2a26

  • SHA1

    559232b44c7583f26ce53f2e199d5a08b2d95abd

  • SHA256

    c324fe32df959176f968d80a6ff1914f2b195c1796376f2511cb97f763f1d905

  • SHA512

    ef5b06f300c04c9cddadff92f7abedb4f5640109cd6abfdf9dda568fb65b756dc0460a0852f2c49d81a4198010e0d0ccabb48152b5005b68db638ff8648aeeb7

  • SSDEEP

    12288:NJOr0Yb59iAIYhQZSjNxfZzT4yoQ8BTjIz562JVbY:Ng7junZapbY

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2