Extracted

• • Target

    SCAN_2020305_14384990.scr

  • Size

    1.7MB

  • MD5

    730917b9f9972445ca54b505c853de95

  • SHA1

    fa6286e202ef441b03c4434e6087c65ba6aa4e2a

  • SHA256

    85372ad7e7596961332805ed270036aa63a776482f46e143c301921bbcaed95e

  • SHA512

    0874f6f9759cdcf389dc5f642e9cbff11d3dcc6e7172bdd13a964eaf32950f0670e797c350b4cccb34ce892ee823bf20fe6fd5f43288bc924ac2e72ac4c0ec07

  • SSDEEP

    24576:4tb20pkaCqT5TBWgNQ7aMSMfCxqn/+TkavB2EgRLBFlvEp4MlI6A:BVg5tQ7aMRCkmT3Bpg3PvEE5

  Score

  10^/10

  discoverylokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2