Extracted

• • Target

    7f1058d62641015d073a4be94c86ff35_JaffaCakes118

  • Size

    1.2MB

  • MD5

    7f1058d62641015d073a4be94c86ff35

  • SHA1

    03b2beac1e58365389708080f587186fab6b6f06

  • SHA256

    b9a80c263d04779089fa4d289f989734ce32c5689ea4a1953147489ac008e18e

  • SHA512

    7516dc4306de51437811fbaa1d4eccb37af9a00fc3f0cd9387ea31d69ba91262850fecf3fa7a18f13e483d865d4b5762f30fa15291f8e2de10a9e3b2ca6835db

  • SSDEEP

    24576:0k6+c2dm2ARIszvLcbtHQgXWjrrt/Px9IwoWHn37ZDlN7CqMonq:0bH37L4tHQljvFfnrZJNOonq

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2