Extracted

• • Target

    5b1e0fabacf35f807e19710def7ba243_JaffaCakes118

  • Size

    577KB

  • MD5

    5b1e0fabacf35f807e19710def7ba243

  • SHA1

    458261a57d94bb58fc02039e87605ab486ee8e07

  • SHA256

    9ec481849ac6bc985263c67265b5de77102efa150fb41eb78a1128c43ebb3646

  • SHA512

    d57a956a7194dd4b50546b8f8aca1b68920d8d0fa35ffdf69933a3004aeb24380685675a42f95b24332a67a418083ad33c1ab647b4941a51d6904e073dbaba21

  • SSDEEP

    12288:sAwebYuH8EbIg5TYzKPSIXijcBM0ezT0DK1c1FMbA09PmPrbaHU9:7wba8EbI1mWIKiMbA0Nmzba09

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2