Extracted

• • Target

    06854e61899fff2b198c91a5a25cff6d_JaffaCakes118

  • Size

    490KB

  • MD5

    06854e61899fff2b198c91a5a25cff6d

  • SHA1

    6b74e8be276b9f16b4732a3e4a2bd69a39e9bf9b

  • SHA256

    e21a9d3df315dd8e55f1178611a622bb43c5be81eafed44c7c7ce1035f0f4691

  • SHA512

    ec87153a038e858641d88d03a8b9142c7838cfcd02795c93299bd52c40a975cb34dfa7792d10615aea8fe6fa3763c395fe84812037d15426bc341c6149af070b

  • SSDEEP

    6144:ih6o1R1khh63aQbSFvU9+kRIluFRfwVnvUjWkY1hdQUdwzMTIv9QZgmT:C1R1kDVvUwGOnnvAEQsqbV

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  behavioral1behavioral2