Extracted

• • Target

    6544c4fe49a868ca0305f4fedf230bcf_JaffaCakes118

  • Size

    728KB

  • MD5

    6544c4fe49a868ca0305f4fedf230bcf

  • SHA1

    1df3bc69ae80054181d32e02c6399b6e6064f31b

  • SHA256

    295abbfa189e8bf61ab258e3857b1055cbefc78cca1cb2bba34eb7315811d816

  • SHA512

    336b2512e57a9d634c95c3ba7d12ce5675036b146dee330e8a45950ca4c89a545f4fdae270f16a8307ded70f19dd931676827493d57703b32b4707b2b6df0894

  • SSDEEP

    12288:u3Wtv3hLqwhuDokuokoCNs+TEmiSkWzwqREjMj+sUEDXaf4IgGTrxn:u3OfBhuCDNLI5WzHisDDqfaGTrxn

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2