Extracted

• • Target

    e0e3dc1e417d5389764b3b9f246041d1_JaffaCakes118

  • Size

    1.5MB

  • MD5

    e0e3dc1e417d5389764b3b9f246041d1

  • SHA1

    0814d6b3631973965b2ca1d13fb11122cc8160d2

  • SHA256

    d7956dbf78484e9250bbc98bd1874a44d1b2a67b5a379f239a3fbe7fdf3e9769

  • SHA512

    036af199917afebcd05f5277a29630f6903b5c88a9857cd0aceacc7cf382bce6cad0d752f50d04e9317ddc92b1dbd3f3259fc9590df98d56e534244b0c616be0

  • SSDEEP

    3072:8Lr9xyY8b5Gz3pjaRjzdqLuF1hot1IknB0vLaCBcKK:wr3yY8w3pj2ki/hwCWCBcK

  Score

  10^/10

  lokibotcollectioncredential_accessdefense_evasiondiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  behavioral1behavioral2