Extracted

• • Target

    c14a6e9a7632cd3936d74adeb656b0d3147ec5233cc01c59a1e4bbd0e4d49b41.doc

  • Size

    47KB

  • MD5

    bac28e6a77c77ce457e4dd46ca5f0aa7

  • SHA1

    70820cbb05d2910b0674ee5f01966ac104ee2760

  • SHA256

    c14a6e9a7632cd3936d74adeb656b0d3147ec5233cc01c59a1e4bbd0e4d49b41

  • SHA512

    083eaa0899540fc2016ffe73e54184b9428ce6fa81662a24738dd65dfcea097806b42bd4eccb2aca4d85ec29ea5b5d7bcb7c522dc5a119a8adfeb464244531ff

  • SSDEEP

    384:twfFAhRp/6j1dhUsQGlWmxDJzkpiSY5UWFnCRMgAaswgYg71p+Hrct2/ac60j28p:SKhHi3KnCWmHzk7IC9swgB71pMCfLIN

  Score

  10^/10

  lokibotcollectiondiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2