Extracted

• • Target

    2bb8eff795e74ff189c0bbd6bd01e439_JaffaCakes118

  • Size

    622KB

  • MD5

    2bb8eff795e74ff189c0bbd6bd01e439

  • SHA1

    89b98ef34938a05d29a36eba1b3684c226cc3a8e

  • SHA256

    6290631ed5047788ee684455fa4602b05f806a329cdbc758d0655d00d54e8189

  • SHA512

    c18def0547436e274e0427850721db8dbe7ad6646cda0f0b899caee3a49b288f012dc43a4e74dcf2b16e93a5c851dfc44d5bf593b28926abc3522140d0bb84a8

  • SSDEEP

    6144:0yHoLoI0KiEPpoQdLuNCaxPiHoftdCo1TJNdXh3JsAKdAfKx/8GcsMBvMCmJp1:0eoLoI0OjokIfO4Jl5KdA+esTCmJ

  Score

  10^/10

  lokibotbootkitcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2