Extracted

• • Target

    6ae111ce271216a564146dfe009f65223a4fd46a50b3607c05c525f0dd697c80.exe

  • Size

    1.4MB

  • MD5

    823d247773815afe3e01f5047cb0d768

  • SHA1

    a8b6b7f4f0284db573bb70c20641accd07111c36

  • SHA256

    6ae111ce271216a564146dfe009f65223a4fd46a50b3607c05c525f0dd697c80

  • SHA512

    8bc770ca324487fa6ff69d510864615947b292cd78dfee1b8f4cb57717008f3ad04e53dc633424c17dcba11a93014a13547ea124889725279f8336d8cdaa3774

  • SSDEEP

    24576:NeniNMFyrDaGm2w2X1zitq8+T8BVv1RIAhjLoamMiX4lNmZg0YxegPbUIDPPJ:An9yrGGq2X158TjLoyEkmZ9Y14a

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2