Extracted

• • Target

    64f4684517c685c9c326a3fb3003cebf8d473150036a2c33d82a55d4b124ec49N.exe

  • Size

    1.4MB

  • MD5

    1c55678b81947128ca2138a573530930

  • SHA1

    3320e6b8c3ef535fa4814d2f7d24e4bdf11096f5

  • SHA256

    64f4684517c685c9c326a3fb3003cebf8d473150036a2c33d82a55d4b124ec49

  • SHA512

    162825e6e5d622ff0a0523ff03ada94a8df455e2c60fcc7358a05653fd9eade3a9c5056d95a530c794334604dc9a1aa1a6d3f7252c04f329617e352a781ce48a

  • SSDEEP

    24576:NeniNMFyrDaGm2w2X1zitq8+T8BVv1RIAhjLoamMiX4lNmZg0YxegPbUIDPP:An9yrGGq2X158TjLoyEkmZ9Y14

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2