Extracted

• • Target

    PurchaseOrder.xls

  • Size

    62KB

  • MD5

    984c876c68da3ddf5b6aac739f429792

  • SHA1

    c0a9d0fdccf4ffbf3297706ab4764c18495f4922

  • SHA256

    685a8fcb7894acbd04b96b69651870187dd9539a959a5b363522ce74b9ff741e

  • SHA512

    d5624df1eb76bc2b03c6ee64565cd2f1aaa560b80cea558c916bfe0f478c4b927eff5cf09b3488c4b0777d51df766daf747a4bc21a8938ed39012e5d0367d3b0

  • SSDEEP

    1536:WnxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAs6/EmovOjA3:WnxEtjPOtioVjDGUU1qfDlaGGx+cL2QT

  Score

  10^/10

  lokibotdiscoveryspywarestealertrojancollection

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2