Extracted

• • Target

    8ccb3cb592018bb05bf68468c6d9006f_JaffaCakes118

  • Size

    923KB

  • MD5

    8ccb3cb592018bb05bf68468c6d9006f

  • SHA1

    459bb1d9fcade603ff1792fbd4c39e4783a1f06c

  • SHA256

    39a883a635482c36178e702745b7364abd72ca68092621ef70eedcf32959d9fa

  • SHA512

    6029c918339ed78814a7f276ede9c569470a1126a278f64c17d118fa5b008a743cf4b7f21c8595fd764618f159cefa5a69794f57e217bfbc1878b77f9c23a0b3

  • SSDEEP

    12288:VT9r2DfxVOk9oX/J1FHH65ChAsKh96tV7W5GlF1mti1zjiEh4fu/dZx2IIA:VT9qik9OVHDyyv6MEi1z91ZIIIA

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2