Extracted

• • Target

    458174931094fea9a1b924440f0125e6_JaffaCakes118

  • Size

    600KB

  • MD5

    458174931094fea9a1b924440f0125e6

  • SHA1

    3f71331342f04184e4aea0cd95ed341306d570db

  • SHA256

    5b25ccbadce2536b0b89cbc7db98ad273b04b8f9f6589798f1c61197977db3d6

  • SHA512

    a95f4bc50636e1397fdb1b44d5a57412f5f99358a24be650baa07cf2b9c4f98e5d81228bfa86c25c07318cf858bab548785f4fc631ad4eca9616a54ec0907cc2

  • SSDEEP

    12288:jWcp8wkfBN7LLf50z1S2a34Yuc0k7x0MvfbQGWTd:qcGfDxO24Yuc0Ax0MvjQ/

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojanupx

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2