Extracted

• • Target

    8f90ffc48876fd292944bcf094a2af54_JaffaCakes118

  • Size

    1.1MB

  • MD5

    8f90ffc48876fd292944bcf094a2af54

  • SHA1

    b5beb068a732277ee8bfc515a698cec1286864ef

  • SHA256

    b326044021db0ac4fd273e9c7747b4adac88e3ab9885859932ae30c6d2d4621e

  • SHA512

    1496dfd48e36d39e0479319d36b20e94e303b36287f2e32bc6c3289ca728630db15a01fee130d27ee587fbaace25b0450689588eac3028645777f1fddda58967

  • SSDEEP

    12288:a3HxvTzdIhHc6s6fvAHL8EIEgCPcuxWlsmP8H7zNA8vF0FBaYE9JtBUCuxiez0MS:a3x3S7s6fvAHa1eWnEb6+O36qCewMS

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2