Extracted

• • Target

    5a0b9e1a4005e85a1de27a91c3e9bdc8_JaffaCakes118

  • Size

    1.6MB

  • MD5

    5a0b9e1a4005e85a1de27a91c3e9bdc8

  • SHA1

    8a39225e2579f66c57c2d98ac5d807fdd7402ab7

  • SHA256

    9e3ec9eb4a826199ed3eacf9c28f7be14535c0958a90f62edb5745662e20082f

  • SHA512

    b21a728afaa69aabc48021bcbe0cfe2deb1ef82c19e5dd93953eb0373e33f31bbb0703f2ff56d8657396922b3ac6e155f42b9b4ab65d1a37868a3b5fb668b519

  • SSDEEP

    12288:7RjwtecfnAwKtkrdRon6Aw3DO2tRfdjLTpbZM5OMIJUKCs:7xknAvwk6lzOydj3pQN

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2