Extracted

• • Target

    f942a3046520f7838e33a1116faf8b9a6615756f044551651207f53b755a024d.xls

  • Size

    1.1MB

  • MD5

    5a69ac58c3133e24a783cf4ea670a243

  • SHA1

    7fdf7feed6f105ce6bfeb34fb44c9c58dfe9057e

  • SHA256

    f942a3046520f7838e33a1116faf8b9a6615756f044551651207f53b755a024d

  • SHA512

    5b338a97aacf226f9e4360eec8fa2149cb5a77836f357e76c276a799625f91ceb4c9b49c0ef13a9fc31a98770eb0088192ba0b05b2ec668beaa5cd71ccc30c04

  • SSDEEP

    24576:auq9PLiijE2Z5Z2amwshXCdQtF84LJQohL7m90Ns4Ql1xzRjpCrHac:auEPLiij7Z5ZKwsAsFjLJQohm90Clvzu

  Score

  10^/10

  lokibotcollectiondefense_evasiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2