Extracted

• • Target

    9831cb6fe257c3aedbfd130ca7c5e201_JaffaCakes118

  • Size

    703KB

  • MD5

    9831cb6fe257c3aedbfd130ca7c5e201

  • SHA1

    2b407fb320d69f8e2d7d415f2180aabbdec27b1e

  • SHA256

    ee9bea2a8cbf506c48e266b78c43afc4831bac1c82648d7334c0f612af5a6b6f

  • SHA512

    ab4228f8c2c68d448dc8df25f0f92ae54ffadd36f83d8568fc29c9be910d43b27e2f8671cf4bbdab488465825a07388301b2046e9f4103b8ab1a76379d69f728

  • SSDEEP

    12288:dXwOJKcpNkfvDngvT5JZG8qztuxRSouq8YM/OLED:hw6ufvkbXZWtIRJD8YmOLED

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2