Extracted

• • Target

    9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe

  • Size

    368KB

  • MD5

    8b4b3d539eece4c9f37c3d73cc5ac84f

  • SHA1

    c5f33f9298ae07b4fc7235ce3f4f37773cbe18cf

  • SHA256

    9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b

  • SHA512

    6307c4cce376fb4166de2c365a7f2ba0cd239729cb7728d0bcd48e592e5f139970710be96452d5b15b4934ac43e86b1e50e20e57b91af02dd23a5716c9aac98d

  • SSDEEP

    6144:wRaTX4VX/Ufjmj5QRG0HgXYityY9FmLxz:eW4VMz5HdityU0z

  Score

  10^/10

  lokibotcollectiondiscoverypersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2