Extracted

• • Target

    495e61951c10165e213e912a81aa4bd9_JaffaCakes118

  • Size

    1.4MB

  • MD5

    495e61951c10165e213e912a81aa4bd9

  • SHA1

    1fedd1b1eb32fd5924512e925a118ae298892a7f

  • SHA256

    bf7d97018913730fa8ebce051ef1d6135ec4fcae2f7c9008bcea0222dc864e48

  • SHA512

    7dd922ed7c554a13dddac797405807e571a5afa8bffd400aa59028c285c6ac991234fbbd2979c7b7948bb3d8fff1a6864dbfa1d34e8572dda1543feb3fe2efc8

  • SSDEEP

    12288:xIUUeaiPu077GQy/ByUGTQAyxLV8QCynDtVsXxgLPQ1K5nQVLKbelu83bHqEt+qk:xIU3a2XGITQr5HDtVZofKNaTB+yPZKz

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2