Extracted

• • Target

    0310539fe235574543f2e741ec52c1e57b19de25078e0959fe3d6d49cc037201.exe

  • Size

    728KB

  • MD5

    757ab1271ec61441cfda6aa5bb8e58fa

  • SHA1

    a0b4f93b4926fc1d77e20c9c705e05c6606b7aac

  • SHA256

    0310539fe235574543f2e741ec52c1e57b19de25078e0959fe3d6d49cc037201

  • SHA512

    dd07566fe433ffb1bff8c4b6c27174e4660e6f70369051e809b11af211dbaf6bba285d8403663f2d8dd72463d8017b3646d5fb5c704ad1866ca10af41d2b325b

  • SSDEEP

    12288:eorh5aElioPvWRJyYBN2wxaVkse5m5+VojHf:5t3WR0YB8wxaVkseg8o/

  Score

  10^/10

  lokibotzgratcollectiondefense_evasiondiscoveryprivilege_escalationratspywarestealertrojanevasionexecution

  • Detect ZGRat V2

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Zgrat family

    zgrat

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2