Extracted

• • Target

    f582c22249526335ae6b2916c0e0fa26_JaffaCakes118

  • Size

    937KB

  • MD5

    f582c22249526335ae6b2916c0e0fa26

  • SHA1

    0c4142688abffa99999cdbeb95468e666cf65fea

  • SHA256

    712fcb950fd221eaee4a2c231f97f45e6f6c1046acb73ffc01a49f21f6a53b17

  • SHA512

    edd3b2881315f699650dc9093d85f7007755d6485872a427d5afa7c0e3530339563396206863047696ec57f18a70ace338882e7bd0f18660c4fb7a734b17c874

  • SSDEEP

    24576:ruSb0vKvZtt9oSO9yhvaH4Ztt9oSO9yI:ybGHtO9yNs4HtO9y

  Score

  10^/10

  lokibotcollectiondiscoverypersistencespywarestealertrojanupx

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2