Extracted

• • Target

    4492d19d68954260f2e0107410b4ca29_JaffaCakes118

  • Size

    861KB

  • MD5

    4492d19d68954260f2e0107410b4ca29

  • SHA1

    a868cf7984f82e26fc10042abd29d446fc00c60e

  • SHA256

    27fb1f8b290ec2212af9f5b2cbe26bcad4def0b89b479734adc2ae6d1d4840f0

  • SHA512

    0833b7e7e2ea47aaab5826fc8f9ecaa89ddb58ff21166bd223cffab837c358f1ef59df467b14476cbb8a68779f4e19dc447b6059c9b9c9b3b0d0fc401f3d4926

  • SSDEEP

    12288:mfAv6B8azBwdmiX+tGAHwp3pmYSdlpfPfvdcG8RSQOQA1533a1VC74/7jXB2wRsg:0k6+c2dm2AQp3awPvOQ4K19Xx2WswMO

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2