Extracted

• • Target

    928ff5bc470a06ca3117cc7c7c23772d_JaffaCakes118

  • Size

    934KB

  • MD5

    928ff5bc470a06ca3117cc7c7c23772d

  • SHA1

    5d616b5b62f32b5da08f09de0b689c4cf3c3fe0f

  • SHA256

    a845c77881759f708fd0c038a96689772029d2fa03a979d3cf7fe392be99aefc

  • SHA512

    dc75b812452447a0b7ba4e7d96f7bfb6da2d114e74426dc6bde647900756afd0e9b9e47ce6daec11f5e27e49f25fd59e4a71be11666c3feec9a8b7db46ba0f64

  • SSDEEP

    12288:QCeb7DnwpWqjbyjxIc2MrDBmKNm5QOmaOeNRinzBqNQMt/A/Kuk5kqcAOXw/21v2:bWDwYdxITUmT5ekNRFNQERuDLAsw/IOz

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2