Extracted

• • Target

    8c1dc01d0de2df096d444514ea7d154c_JaffaCakes118

  • Size

    447KB

  • MD5

    8c1dc01d0de2df096d444514ea7d154c

  • SHA1

    d17ff796027a4443c864ba21ce2a8db7a1760c7f

  • SHA256

    58b0af868786683e720d7801e320d1003672209101d34fcaea87b0f4c0711ee5

  • SHA512

    41837ac14fb14220facfaeaf351e3af69ee98f2897e16e32933eca229c492413c421b5e3c723862b36fe47e59663d5853b4f0524eaa1e4ef21b474ff592323f3

  • SSDEEP

    12288:5I6YiFZWdaP6oNt5vb/OI7UMJa482LNmRY:5Ch0PFD5D/t7UgL8agY

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2