Extracted

• • Target

    PaymentSummary Ref20251702e24.bat.exe

  • Size

    752KB

  • MD5

    d797e38b4e834b0958c23a615420f202

  • SHA1

    689eede70a287d1038834ef8c972d8152fb2116b

  • SHA256

    33a9199e6a15c0cca7a30439f71a166f9b475a0ce4d1ca548845ec8c49f5fd2d

  • SHA512

    20b896c94cbb53dfa7d3f8c1efe58bea32f44298f972a85a8a1c42de8d32cabf396fae65234c112c4b6a454f3ac62e6f967d7a37ffbeee95dc37bb857253d3f2

  • SSDEEP

    12288:/q06zTfURnHb+Qv6HNbwVhJ8uRT6CBXnpTBD+GDLK2AbyZCbpadsWaoztwdudx8e:CVMRHPv6tkVz7RT6on2GD2oZypadsWjR

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2