Extracted

• • Target

    c13c110cffdbbecdfaa42c50e3c44b5c_JaffaCakes118

  • Size

    340KB

  • MD5

    c13c110cffdbbecdfaa42c50e3c44b5c

  • SHA1

    5439bf37d859d9e2761f6d114c0c4c710cb52dd9

  • SHA256

    943e5f09003c8ba948a4d8c11db59af55e5527a572832e59ac825f344bf1cfff

  • SHA512

    81daa7f9bed54fae05787b3406eb2156941d88cca10df1c13755f126809f8914c0e0d263b74003c7e79741fe4461abfdc8ed284aef879bd516a72610c59242f2

  • SSDEEP

    3072:wgDhwYjEx72RnLyzWESpGPh4Y0DfuCyU0wlNKsOTNZ8Kf239SMSTUd5NRcLahZG4:tWYjIWnmzWNEp4ymNKs1A+Rcmeays

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoverypersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2