Extracted

• • Target

    917907d1dea3d46c1685b6095874d13d_JaffaCakes118

  • Size

    793KB

  • MD5

    917907d1dea3d46c1685b6095874d13d

  • SHA1

    42f131d3a8e26906154e41eb3fc3a137571bafb6

  • SHA256

    64c1c7ac5f0615e99250e0bf9e633110d95d1b0bc3c9bf23a36ea93fd7f378f6

  • SHA512

    a98ff156969b5dfebd1dffd54d19702ce15762855e3305cacb4c0bef2b8def76146a8a3462ada63403dd5317d85c941461934c20eb63bffdb02537499be3fe81

  • SSDEEP

    12288:+hVxw3QAnPVtK20o2Lw3QsHsCwh2q+OpoTl/wWuXIF61v:cALnPVE207eC2pOtXmqv

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2