Extracted

• • Target

    C27BF6DB51F64901BA56CF64003CABD2.exe

  • Size

    733KB

  • MD5

    c27bf6db51f64901ba56cf64003cabd2

  • SHA1

    005e61ccfa9a0840d788bcff2a95cff7ec88d6db

  • SHA256

    3439eaffe1dfd634b46a29ee7f0e938b5b05f9c784123a70b94f9f46aa370381

  • SHA512

    1b3b19272c1d0ae7be07b4be04fbcc58e46b9fedeb31a4292bd3e8a270a2deee22efdd9891a26e708ac5d987b6996cefdac64665a685f52cbfcd54e66eb1d443

  • SSDEEP

    12288:WcrNS33L10QdrX2mVnCGoe0cZKqMEF0JCEharfH0uceMTLlW44UdLZeZ:FNA3R5drXbVCGoRcZDMEwC9UucrjLc

  Score

  10^/10

  lokibotcollectiondiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2