Extracted

• • Target

    7cab67f3270d22af388a715bc460f69be5f200da4576be5940c190a008a2e765.exe

  • Size

    508KB

  • MD5

    1714930e93d8458a2de4792fc3e54551

  • SHA1

    1117c156f9c69ceed004451ffe37f0059887c2cf

  • SHA256

    7cab67f3270d22af388a715bc460f69be5f200da4576be5940c190a008a2e765

  • SHA512

    171811910a5edd83cc53d332e713bfc4641504ecb1d6828c64c83695916fbb72a5f8429b2ae3edbfe0394eb9e1b9dbb17f60cce2ba6df6411e04314334767d07

  • SSDEEP

    12288:B5MOiV1J/8dHfior5lGqTYL+kRdnC9VZPJTT:B5MOiXuX4uYL+kbCJPFT

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2