Extracted

• • Target

    5302df63147c13d7c548a7c2bdbf32a5762adbc2763e5347bff4ad446316c072.exe

  • Size

    629KB

  • MD5

    d313053254946813d23ad85448542115

  • SHA1

    e8bba219c193ac745b397768f8962e743a891373

  • SHA256

    5302df63147c13d7c548a7c2bdbf32a5762adbc2763e5347bff4ad446316c072

  • SHA512

    e4ad678b13df029db48d56a143d289982ad4ed9e72c7c096f34b5debc4ce3057c31d4fc082f2439671beb6fd7392c87d9d296672bd52206e3c86735013534237

  • SSDEEP

    12288:S8iWXV7ORrN12SgGfdea2ulI5W3uFPoT+y+vLUl2DkBx3P:xOb12Stdg6I5W3uaTX+PDkBFP

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2