Extracted

• • Target

    3c16488c1bf94c166438cf8b0c493f92_JaffaCakes118

  • Size

    594KB

  • MD5

    3c16488c1bf94c166438cf8b0c493f92

  • SHA1

    3b39cadc38e02feaab919515b3e6063d859d4f5f

  • SHA256

    beb0f3fd9e54f1a8318055fdbc6fa22744de40502c808ba7986fad76c888fed6

  • SHA512

    65dc2af01296115d150d8d92154cc9851bdf083fe7ae047bb1d93a9d136f5b5c6b7a1882b09943fa04bf165a71ddf753da0abe27ff5377e4d7aac93bf2d23c6e

  • SSDEEP

    12288:/OkW5XHwxkaJIXNpkcEbSk6Gsgxu99mXDyeZE9naydU3SFTqW5zm:3W5XHakS8gcgSVLyDXC4EUKTqW5C

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2