Extracted

• • Target

    f1b66d86344a6b7721cee9092bec9d69_JaffaCakes118

  • Size

    1.2MB

  • MD5

    f1b66d86344a6b7721cee9092bec9d69

  • SHA1

    880f0e144fe4ae8952a7318d5d4320b459c86ec2

  • SHA256

    c2237f9c8ee1a6ea3503bf86ac791a4a9ffeb27eaf2fb7ebe48ec39957499824

  • SHA512

    6351d57787f38e488c1d9fcb05dd09f3585a7d9b044d8476d13e9850cf15604738c9d1e55e405a1d6ebe22af40fcb384a07559faf02cc94c2124afa4a908a6e1

  • SSDEEP

    24576:xIRIvf2xOXNy63VkuisU4YyAeXqom4WnOCUsWQKleynbtl5s:0

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoverypersistencespywarestealertrojandefense_evasion

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2