Extracted

• • Target

    9ea0e62cdc6ec4e5a0c48f45e2c117632b84b09c6e84c9d89444aec6c2418e09.exe

  • Size

    461KB

  • MD5

    7e31be8bc7f77a577e69f73c4f1177f7

  • SHA1

    ad1b66a091ed9d81d4c5dc7238134350ab483562

  • SHA256

    9ea0e62cdc6ec4e5a0c48f45e2c117632b84b09c6e84c9d89444aec6c2418e09

  • SHA512

    a91a193db3b9a6e7bbd1afc2cf213fe1780fbb6640a6136baf7844d4e3f00ece401050b901c030c2cb37638f6c3362d2ee6760c493ba854cf58dbd348d94d98f

  • SSDEEP

    12288:NJOr0Yb59iAIYhQZSjNx+bZzT4yoQ8BTjIzW62JVbY4:Ng7jC2nZtpbY4

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2