Extracted

• • Target
    Payment receipt PO 1437 1_ Payment receipt PO #1437 2.exe
  • Size 536KB
  • SHA256 92e6e90dd6fb4cd89fa077cde338876ccab7aea58cd213838be250ed83eb0247
  • MD5 5a4fc3780cfc0527d12d8bb5134a81f5
  • SHA1 de3a05f3e410bb8b30e0b4d8ee32a3dcccbd2837
  • SHA512 60f3087302e56df45e19afe1efe1b1dee8b34dda304ed2a7fc7526752207108da7e53043e71c2989a6c8832c1b4fb96658efadbad59bedc3adbb19d538e4ec70
  • SSDEEP 12288:6/fRpm+gvyyw0zglG47TqrhSFH3GzsqHG9dSdp2gxqTQ:fdvz8ql429YQTz6Q
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2