Extracted

• • Target

    43e710d54cc34ae668a10b0ce9e89fd4f7d147cef34c7d44275ec96be9cfb901.exe

  • Size

    704KB

  • MD5

    8c4da707092623f03586e61f56755840

  • SHA1

    69be0cb3d2d2a7930c675449636d988f22d5f1e7

  • SHA256

    43e710d54cc34ae668a10b0ce9e89fd4f7d147cef34c7d44275ec96be9cfb901

  • SHA512

    a4380540eab3bdf8c5d4a0509900a2bebe6b2d0d2778f75a9c393119b6b75db5144fe340913c1104447223526c2388a01a8df82470e0e24312e09a3b1ddd5f44

  • SSDEEP

    12288:K2sv+SGjpA3yKUUo6a+bJCj64DG6rGdb7XHZH/3hexOG0CesaCvzCnYb+iXw:K2xj8JCu4XrGRB/3hDRwLCnYnw

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2