Extracted

• • Target

    7e7a78f8808e85ba09012d30183937a2_JaffaCakes118

  • Size

    887KB

  • MD5

    7e7a78f8808e85ba09012d30183937a2

  • SHA1

    441103a9d35152455aad5f354dd0188777b92ea2

  • SHA256

    797c385e138f4fdfd7158e6126e43704b2885558140d8eeb060d2937f8afcc0b

  • SHA512

    49bbf9b9871c29d1f0ea70b3eddfa68d30ada20626c8502ea0b2b539047ee705f8869d1a75acb97032f1843ee7aa90b98e5cc5b742f9660a760fc21cf7cb9855

  • SSDEEP

    6144:jFGBQsHrIQF1bdscQ/a5HUVFdThj9GFhLdx5q9lOoLHI:j/sLJFzP0a5+jhAFcTM

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  behavioral1behavioral2