Extracted

• • Target

    afb9d83cfa733ff2781ed1be06e3bcb3_JaffaCakes118

  • Size

    1.2MB

  • MD5

    afb9d83cfa733ff2781ed1be06e3bcb3

  • SHA1

    9837a44a14f9410568be34740013c8fd7ace8af1

  • SHA256

    9a50a70e29b06bb28d2f26d88766c315c4257685effd919bcfa0f62bacbe58c7

  • SHA512

    5e4f5c823e4250a8f4f3b9098d9e835128f1cea759509ead34587f625a7cb93942c4a3a890e1041dc5bca5b5bc4f7da3774a4da231361cdb6017d6e8fed8ba5a

  • SSDEEP

    12288:RAaIsP+k7bh5UFYzpiWua5jJQcvQHVuy9KbNpdxnj4iO+9vIssQgbp5BGkojernW:RAjg7bhZAhabOARhjFW5Qgbp/sVYu

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2