Extracted

• • Target

    ecc61fe635e2cdb0859441ef90e330230094e7514cf00cb48829e136d713b63b.exe

  • Size

    506KB

  • MD5

    f4a43c4e63d1bc8908819fc2b3b6a83b

  • SHA1

    03f88667ac44a41a2b5e4b2cf48f23302ae79b6c

  • SHA256

    ecc61fe635e2cdb0859441ef90e330230094e7514cf00cb48829e136d713b63b

  • SHA512

    6f1ce342403bc33f5dabfa0260da8f45bfd6d3bdfe72df20e0a617f71bf2abe926a29393d4a9e4621ee8a5ade029c20ed025fe377ab7c1d6f954f866c1efe76f

  • SSDEEP

    12288:FOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPi0Q/mXWb0zjnfxNNZjXO:Fq5TfcdHj4fmbjQOXQ0xNNZjXO

  Score

  10^/10

  lokibotcollectiondiscoveryspywarestealertrojanupx

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2