Extracted

• • Target

    cbb16e4e4e08c92f71f92912ee89d99f_JaffaCakes118

  • Size

    496KB

  • MD5

    cbb16e4e4e08c92f71f92912ee89d99f

  • SHA1

    837c8f172b6a8e1af9d906bfe9e2910c37af4159

  • SHA256

    ccbcbbf0c8ab0e133382d476d1836596502dea3a459923e3b7b8462fa0ff4782

  • SHA512

    591ee2940ab8c6a53fc824db1fbf6300677430d9b39eb6437d67e8640fa7454c428b20098323e7663de8baaec11a12392b7b6224e6f6cac9c442ccb439561269

  • SSDEEP

    3072:ZEwLwjDHoRQoE/dVEZYIt+R9pna+10ez2kWYj67n0sN0o2ibcH0qwrUm1tEfaK:ZEwLUoOoEsZYIU3nIeYYjftwn1ty

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoverypersistenceprivilege_escalationspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops startup file

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2