Extracted

• • Target

    PurchaseOrder40360414.doc

  • Size

    600KB

  • MD5

    62d9f219d4c67d21a6a125597804821b

  • SHA1

    48a46d13ff5571ba085cbd4b9f6575a400199d24

  • SHA256

    0c10532495658ae6099011796249e76b9ef33235a019df54086bd07547685354

  • SHA512

    3296f44e94c842d970de96ccb1c4dc41516f4e7aecd4b5dc22ebfa50238c1f853a169fb90bbfbc8eece44b047987a4bc765f63c263b93deac2eb4162bf274b44

  • SSDEEP

    6144:KwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAE:j

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2