Extracted

• • Target

    9e39a3fc8fca2cc19c64e0c75e88f897a7d07f43d3430596fecdccae2b36d680.exe

  • Size

    708KB

  • MD5

    ff0a37e1048052c58526a9c38efc1954

  • SHA1

    cdb18e6094372c6ab8280723bb9c64b9ba8269da

  • SHA256

    9e39a3fc8fca2cc19c64e0c75e88f897a7d07f43d3430596fecdccae2b36d680

  • SHA512

    5ebf8fb73960113811b77534bd773f1c541fb381775e7944cc9ca8d0d48fb2e07d8d63163b074e8dac89d61aa698325ae2fa020a1b15695f0ef87531f6fea411

  • SSDEEP

    12288:mfuj5rWYMV+I4MVKWTwxAVNhpDsWpwEQx4JNXwwaFi3oqW8JdKPCTjcZPq0vzkR:gSrGRgMwxAVNvlvXw5LAdKKn8M

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2