Extracted

• • Target

    643370808d5a76f4e803d02e59abd0db_JaffaCakes118

  • Size

    542KB

  • MD5

    643370808d5a76f4e803d02e59abd0db

  • SHA1

    1b82756f5f5f66de46d4402a83fe0fa0ccdc0a96

  • SHA256

    48262847ce76b06634e13f24a48c29437340eace2314029474d0960ab09cdc26

  • SHA512

    d1f8ae747100656b49cde6e604f800ab9e07ec95cd4efbf17eca6a991869d2361ab5ec5e7b86bd5f05fba8a9e40c46ec0a2f5baccb2bff739f0506bb31cd9a1c

  • SSDEEP

    12288:yy2o1+WuinLldke+FwxZQI+d3Rf1c8m0Sn:zh+SLHke+Fw4BFSn

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2