Extracted

• • Target

    39e318d77829583422dcca018d41a0649818d93f9a5ae7ee591d770b3eb14129.exe

  • Size

    701KB

  • MD5

    7a51a0d98cdcae1e4b54c213e72588bb

  • SHA1

    08a9af0432164f29db073d34edf25b7977f3573b

  • SHA256

    39e318d77829583422dcca018d41a0649818d93f9a5ae7ee591d770b3eb14129

  • SHA512

    291d3b6d61e87018dc13cb089ba6c7564ed027b54826e9eab823b9d8e3c099bb6db5f2dc30d07edebd0eb97724854484919b7e6b0301010cb415a0c9f7ff02e3

  • SSDEEP

    12288:7lXU2iNQAaABk3lM+jKdJL+lDBAR4H7zKOw7gHKkFdDgMwq0GdauwkW:7ZU1x6M+mPL+peR4bzKOc

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2