Extracted

• • Target

    a5350ff592171ebe67d95e86b557751d67d1f47fe87889b0ffbd0509db14813c.exe

  • Size

    1.1MB

  • MD5

    d5cf93a33671da1bc59838ec0e0cc3a0

  • SHA1

    11ac6fdd8813552b00150c7611755fd04b6456c3

  • SHA256

    a5350ff592171ebe67d95e86b557751d67d1f47fe87889b0ffbd0509db14813c

  • SHA512

    162b1d5a9557f0c064dc33fbb3c769ce9a44d873d2e6a68d55474ce908a3eca7fc4e276207dec72c986d9cf0c214876172f28fdec261bf5b17ae621be37e27d0

  • SSDEEP

    24576:oqDEvCTbMWu7rQYlBQcBiT6rprG8aLF/IcUuJ94fdFc:oTvC/MTQYxsWR7aLFRUuiF

  Score

  10^/10

  discoverylokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2