Extracted

• • Target

    8149a337bb931a80f7a0bb181e1c947833009313477f332957917b0b2d6ae067

  • Size

    829KB

  • MD5

    768e6a7c95554c3e09f9e8fec3a799d3

  • SHA1

    d59e1263245d278ec9ac88f604e5c010265065f3

  • SHA256

    8149a337bb931a80f7a0bb181e1c947833009313477f332957917b0b2d6ae067

  • SHA512

    7d3749a9d1446f4d94991aeb4f26e29132053d9fd394970bda30828a092b4d8b76c227e1be52de7e9a5aeeccd1411fc5d09e06e44f2f074723bbc61eae7af435

  • SSDEEP

    12288:Dr72JCUW79gGzdP+eCSmLYZgl2JSjqyURTZAQAnwzvIbqQToysjwQzXLkLJq8vgk:al6gGjCFYfMjq/R2+QToRjwQzbD6kP

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2