Extracted

• • Target

    RFQ Enquiry Files.exe

  • Size

    588KB

  • MD5

    cd7e57947ce80d5c613ba6f761ff1c0d

  • SHA1

    88c2e06cff9661fd1c35eebca1b20466382b83ea

  • SHA256

    2796c9a06becbb63d358c4c25e8bb6bb686deaf10399c3a1c3bf140dbd0133b5

  • SHA512

    4f5d013acfff38f0da01fcf139d02937f8ef3fe0aa47e753f2177b60ac8879c1f73bfc886bdc6376ffc1c9358bb7a73778f7e0dff9d9c058d30fd480e457c63a

  • SSDEEP

    12288:OFa383le9ciJv/AF6x50QSpEptEwBoIxqpN080RBqyS8mfizMbnkR:kU3TvokApEpqwKyA088siAe

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2