Extracted

• • Target

    1601fd5152f9fa9551c0c61fb208ebb7_JaffaCakes118

  • Size

    182KB

  • MD5

    1601fd5152f9fa9551c0c61fb208ebb7

  • SHA1

    ff9a3397ce9d5892764259555c4c58ebbdcc47aa

  • SHA256

    c359fd0f9dac8f4af2962f21260dd4661fc27a7d787e1e6c7a71dc056b95071e

  • SHA512

    10415c15333a029db1d8946914513f7de382bc59a26538c8812a5dc190c71cc63db4e387debc47d658758a49589b9c3f8ef5427568743c1e487374365a8c9f17

  • SSDEEP

    3072:yWXiRLOS4/mjVkdfuU0CYDSPeur7MSx5PfLItnemS/IrJXkP+U7FaliJh5Hzws3O:yWS9KOVkc8eu7hx5PMtemSwrJXkP378L

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Modifies WinLogon for persistence

    persistence

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2