Extracted

• • Target

    PurchaseOrder.xls

  • Size

    61KB

  • MD5

    e89259df459a4658d9d97fc964705dad

  • SHA1

    f6134239d4a25fe4f7465ecc0eb52bf06623d658

  • SHA256

    644c4d8e1df0f7ae73497d7d5f94ce806e54b611b2ca60cf28ea0a695b28f2d3

  • SHA512

    b52ec1e5861dd7aec964e0fb32a0bd0a11de8be928722ad405996ee09a34228b57d43d7de10e16f1a3215bc196ddf66c3fc6a9f959fa2205a0759ad0f8d3fb86

  • SSDEEP

    1536:ZnxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAs6/Emofq4+b/:ZnxEtjPOtioVjDGUU1qfDlaGGx+cL2Qw

  Score

  10^/10

  lokibotcollectiondiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2