Extracted

• • Target

    000bb339dba05ea8f454258721dded35_JaffaCakes118

  • Size

    679KB

  • MD5

    000bb339dba05ea8f454258721dded35

  • SHA1

    2ca26c715dd45887a5c3fd0ccf6883972ed2af94

  • SHA256

    d4391a7a1eff8f02ebd49ae4a61050b825eed773d3cb5a8bdf5603daa1e77657

  • SHA512

    e3076454e0ce0a2c7f5289e98110dd3a8aec3b993eb34be90ea023b855ac05fb61bc54a14e388cea75020a828b75666f091642894b6a8a0e9989453f4e9956ae

  • SSDEEP

    6144:mGE+NRU+ueOwjsBjZ6ch0rWNOf1lxjO14VVAGy5O/B/ZF4:mGEkR0eO3HKS1Qi5ObF

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2