Extracted

• • Target

    daefc26d62c66001235878a222f32bb9ac898a8d49648e50f4628442f66019d0N.exe

  • Size

    701KB

  • MD5

    7c87cf0d01ecc72d71c122cb53c56890

  • SHA1

    69895513a628625024b6f1051d0816b6b89c9c35

  • SHA256

    daefc26d62c66001235878a222f32bb9ac898a8d49648e50f4628442f66019d0

  • SHA512

    331ec67361cebab739183cfd4587d602e9af6923054783c25523b035eae2435dcf6ffd29e04574d998b1c0bb6dc08653721fa4e1b077a30ccef1569668a6f0d3

  • SSDEEP

    12288:7lXU2iNQAaABk3lM+jKdJL+lDBAR4H7zKOw7gHKkFdDgMwq0Gdauwk:7ZU1x6M+mPL+peR4bzKO

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2