Extracted

• • Target

    7RryusxiMtHBz80.exe

  • Size

    1.2MB

  • MD5

    4bdc5e698f6016a3c1d15e2d8fe5c688

  • SHA1

    4696280dd50fbabdc6e96438d27fa08f3a29fa44

  • SHA256

    7b1d37ad80336e2eda4720deb2dd61b353c9ea2071f9cc2564b4fe28d2ca775c

  • SHA512

    a058edb63eb4c17d0293d1ac61daa395b8c5c5707c07e4989b48e5bd780c593d47107ab84b364aa6fa78906550287b9ee975303b581514b11e64e57ac22468af

  • SSDEEP

    24576:0fDeqlUhQdRq9pg96U3gn3eIPqNs8QBlo2G2r7iTXRxqNS9:0fDeqqed8PYtgnOmvlodNzLqk9

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2