Extracted

• • Target

    Purchase_Order.xls

  • Size

    62KB

  • MD5

    69706b59e0a9a130bc805feea9a012a8

  • SHA1

    412c5e987a7daa26587c57153832343e7e5dea19

  • SHA256

    614e337e02f5cdedb1408523051dc458cc2faa2a5557808d4116bfb39616bce6

  • SHA512

    fab78de8d85fd560ed7f87f2843581c15713cb6a4bbe83cd5bef3ac83ac7a8664439e4a6f5b7f1ef5be4936dd6d083c249f3c3d8599b070d9bf8eefab31dfc98

  • SSDEEP

    1536:tnxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAq6/EmoPR+Dz:tnxEtjPOtioVjDGUU1qfDlaGGx+cL2QX

  Score

  10^/10

  lokibotcollectiondiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2