Extracted

• • Target

    OEoRzjI7JgSiUUd.exe

  • Size

    1.1MB

  • MD5

    9198587cb5ed3fac57fe2693b7218dca

  • SHA1

    8cd1838744b27b7ea50f62a1f32d9eb8f93aafe5

  • SHA256

    b6383a5fe17a23dce23e59aee55a9d304e60b25cc7cefe9d97e7703b0886c1bf

  • SHA512

    9a50e02242312e52f5f2fe0f325eabeef660915196d9c383e2d7d59bee03e50882c088af7aa1676fcaf62f84291e9fdf87e51661973834fe2050d6145ea17e08

  • SSDEEP

    24576:KMrbCRQqsvpWvo3d+z2ukIlht4jt8CJjTP4XH8Ti5Ks56Tz1:KMXw/svpW2m2txKcl

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2