Extracted

• • Target

    57b32bdc1cc1398bd45704adf17f5835_JaffaCakes118

  • Size

    693KB

  • MD5

    57b32bdc1cc1398bd45704adf17f5835

  • SHA1

    6a19d34239014af5a81bb104c9c83e7a47da8ac4

  • SHA256

    d3b907e0a51770ee3ac166c231ad5e15a77d9c71399587a5ffde9518e2dbf2b9

  • SHA512

    d1c2a36ceb83bd8443d0993433406af78cdd756b8bba5526f642f0d4d38d7fabdd67164940146254c0b2b03cd1c38f958cfa20eb7957e57f2098695275c7d803

  • SSDEEP

    12288:daRcNdXuXAbodrGevgEefZnGhFNEvRWlQ+esTCm38E:d/uL7HAF092mM

  Score

  10^/10

  lokibotbootkitcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2