Extracted

• • Target

    SAILING SCHEDULE_pdf.bat

  • Size

    526KB

  • MD5

    df6a8ea7ddba625fb871b9e8cae61d20

  • SHA1

    bc6fb1a28184482e6b2a55df74271c6cfa1c6a50

  • SHA256

    c04d5501e6f5d1154e27d0077628c15979926713696ac35beda2b6d8aa4119e5

  • SHA512

    9b2630afceaa2a0561bb8a9e8713b0a264d86d5580a8bb30b75402d9540d62627915af7deeb7de104a7f1f69d97f8981bfc5543e1119a78b7a3b7509c4472dc8

  • SSDEEP

    12288:8PSfRWxZuHr5NSV1RSWZVh4B4HdkbJMSjZSx0/vGv073GNR0u:8Pt/OjSV1RTZV200M6ERv0Z

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2