Extracted

• • Target

    a7094a68fced829653d5048ff4284ebb_JaffaCakes118

  • Size

    797KB

  • MD5

    a7094a68fced829653d5048ff4284ebb

  • SHA1

    897442a4236d342f17e19180b7619286ba6338ee

  • SHA256

    5d40c51f90bfc15f3b3682dbd0c4f53d89eecb6fe2721da8b0c50d72edf3986f

  • SHA512

    81b72f1329ec6ba901f4830e0bada41f0059b6328beaa78c12992856efaeadf9ef75441ef94567bcc5b8faf43d7e00bc30c8097184e9d18518da5a904ef897e7

  • SSDEEP

    24576:wnIRIrPgX0QMMjcw4HmhTcjgEAE6aoPgX3:K

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2