Extracted

• • Target

    Payment Advice.xls

  • Size

    242KB

  • MD5

    8257b2f37dd713ed1f056204cdf84e6e

  • SHA1

    f3d26a25afe7b1a17193f251e8c4ae6f0b021d7e

  • SHA256

    c02e7064462448b811e6f409fdb38c843ea88825ce6c4051a3da8a1bdcf0a207

  • SHA512

    f48253fbf1e77085ce4a4768df0614e8564cae224a8ca9191f85cab89190e0f99bfff0d1dd1bc8af47b30259df325f3a23eeae57e33433498a0de2a6e8041a2a

  • SSDEEP

    6144:lW8qVHtEKHBMixiMK6G+ZFrTABinx0japxld+Syh:E8IHtEopozwjTPnSjaLv

  Score

  10^/10

  lokibotcollectiondefense_evasiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2