Extracted

• • Target

    Orden.xls

  • Size

    60KB

  • MD5

    b599ebf4acf3f137ea8818e3d8e33250

  • SHA1

    c96df6824d877a8c29b865bf492868b66e36fc4d

  • SHA256

    6cec1f390f674cb7808f727c4c1e147cc35728aada372e22a72a1a2a75c1c982

  • SHA512

    fd70ab2a4f43dc3d5fc6614a9f1664c056b665399f007c25d42664feeee95891fc74709ecebc486b49f99e0a8eefefca93a90dacf62054ea6e13bd5726591f21

  • SSDEEP

    1536:+nxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAZ6/EmoP+Lszm:+nxEtjPOtioVjDGUU1qfDlaGGx+cL2Qt

  Score

  10^/10

  lokibotcollectiondiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2