Extracted

• • Target

    868444860f70d7825d5801e3ebdc8e9f0c5ffe72c3f42a938b7df98d50e10758.exe

  • Size

    599KB

  • MD5

    7e1d910ade786c9880194ce5e7c66c8b

  • SHA1

    c2dee65fd0b225e9ecf1ea718d1015359f7132ce

  • SHA256

    868444860f70d7825d5801e3ebdc8e9f0c5ffe72c3f42a938b7df98d50e10758

  • SHA512

    def1d3762997f41ff2a045fa6428f30471a3e6825fda0bf880789a7514c4855e7c4064fd2f1d6c7d211a729b08acda2cb40defaff91dd84c467f1edd52285a0e

  • SSDEEP

    12288:1L3qZB+Zno/SWqpqqMDz2aH3gId4Ti/lkUNz3PLhRN1YlEUWj8kR:1L3KB+9oP0qTzJbmelkUR3PL1JH

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2