Extracted

• • Target

    6c34f10c3d2c89f5cf9627bb23b71691_JaffaCakes118

  • Size

    584KB

  • MD5

    6c34f10c3d2c89f5cf9627bb23b71691

  • SHA1

    74636b7aa84a6c0af2825de34b9361a2cbb728f0

  • SHA256

    7adda9520710a3270a496fe331d9a6c22da3d8ae82972f2c0ca215ae47f69d1d

  • SHA512

    16dc89cca84380569df81ef5b122b3a4e43a6ea5ee05bc905081cdbb2ce312fb9540ae25cd1723b221559db1b0a9705cc71ffeebebc0c7c4335bb5e30d6aa77d

  • SSDEEP

    12288:7orBy2qFxxSl/J94GOI7CDfxiSm7y/6Nj8AgN/FeKKs0xIhv9Ums3aLWPVI:ipqVSlhabfa7Y6NYAC/Fis0xIu53aLW2

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2