Extracted

• • Target

    50429b6cb4ef0a6d29f292caa54f7295JaffaCakes118.bin

  • Size

    536KB

  • MD5

    50429b6cb4ef0a6d29f292caa54f7295

  • SHA1

    79a852f98f6b4e2ea1ef9353c77c18b1017355e8

  • SHA256

    cbc35ecabbdbca204a8e095a878ead95ff71842493ec8365865c421b38861ee6

  • SHA512

    2ccd788406d1c4ad56cee9d0386fedf6836273c908eae1fb23dcd6230413c7dfaa194d3fbbbb3c76343b13f2a8b64998e8a3aaa79f525f03789b78ecba1e05f6

  • SSDEEP

    12288:8vpSsqzU5Ht1OSkVC8/QwQZkKIEamTJbiszTIX7yQO0B:8vosqg9t0SzSckKPNisXImQVB

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2