Extracted

• • Target

    90403b6ecf93cd9ff81844bb948977a7_JaffaCakes118

  • Size

    579KB

  • MD5

    90403b6ecf93cd9ff81844bb948977a7

  • SHA1

    9874db78ffd3b4e74751b3edc009042f0f0826bc

  • SHA256

    39db4dbad735788435f723ce94fd9324eeea6a736750cd64e3d7f2c9bc237e95

  • SHA512

    46eb16d24bda4bf7ad2300b83bc6fcb611222646be4ef7bdff5789901426ef502bfb7864368895a01aeda9fe7b14179796951a5b78f79087a52d956757e16b84

  • SSDEEP

    12288:DdvK21V4zLlMPAiH75e3Qk2NPDyE38Iba+v4P8Bart9PQbZrWw:hy21VwLkAQaabyEsIe+QP8BY0Cw

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2