Extracted

• • Target

    NOGHCV09872.cmd

  • Size

    657KB

  • MD5

    14d9c4ea1e0aac13bb62e8913e5f8738

  • SHA1

    c062261875473ba241637085ceb3a33631f1b333

  • SHA256

    3dea4c555b6118e7963f57a4415692dda5c644e5675c6117c2846808e833191b

  • SHA512

    1307ae1b1dd1aaeda153530125abed639c293ce9dd8b09176b2650ff4d6494cc98c727e53799904608fd65ec0fdeb69b322d158a1a4ee3b0c4b5ac9e25ed5126

  • SSDEEP

    12288:KsHzOUNUSB/o5LsI1uwajJ5yvv1l25AMp9WV3W1l+LYIgUg4Clln98jx:9iUmSB/o5d1ubcvj5JUInjCl4t

  Score

  10^/10

  lokibotcollectiondiscoveryspywarestealertrojanupx

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2