Extracted

• • Target

    2423f7f4760abde3ea56dc0fe3c2ca64_JaffaCakes118

  • Size

    336KB

  • MD5

    2423f7f4760abde3ea56dc0fe3c2ca64

  • SHA1

    c6355248b01b1257f61c0fba4d4f2e3302a1ebcf

  • SHA256

    a4f95f33320c2520836f546c933cdb167943aa51e8ee7001f72e9adbaf442fe4

  • SHA512

    6192745ba233057508c3f65134a04be1f4f2fc8b0f1f273bcda7de43126c14cb43711318210cddde0fd2f0af3e4414c798863fb75ccd8266e6541b7296160342

  • SSDEEP

    3072:zEbCnCdktWk9hvJls5fPzBRvwbEn5OiWzWq6tC:zEupxhiHzB2o0iC6

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2