Extracted

• • Target

    ddb5e23628ee7ec31f19fd22b9183896d27f5dca982a9e68a189dd32c3fc42b0

  • Size

    631KB

  • MD5

    34453017763cd28119be45767713eb08

  • SHA1

    7e4312d2659819b914b2945c52f9e7a144c2a177

  • SHA256

    ddb5e23628ee7ec31f19fd22b9183896d27f5dca982a9e68a189dd32c3fc42b0

  • SHA512

    34e3479a4a43bb692f9ad705312bceec15376f078a5543a94001599f8e445118844e7111c4b37bd3fab59c9bb36c3c244df0efcb798e3263f67f2e1df3445eba

  • SSDEEP

    12288:vbt9loJNhQ/cWS7stXlQscP1vt7CMTGhY2OizRilLzaxT4Z:7iJN+UVsIsy1tS1slqxT4

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2