Extracted

• • Target

    fe3bac9537f8f1fc4ed4551dbb50acc7_JaffaCakes118

  • Size

    555KB

  • MD5

    fe3bac9537f8f1fc4ed4551dbb50acc7

  • SHA1

    6405038b35dadee97d717624f595ecf195c380cb

  • SHA256

    3216b19575630a8841ce5432df563e1a37814abfebb2e3d3714239c7757498af

  • SHA512

    1c77afa9d9492a7c48cd96262d264a1fcaeedc96f9d57847afb115c31422a96799ede408dd4b6aa542bc5ba9932030d77870797429786eb7bee4c56aa6a24fbf

  • SSDEEP

    12288:Wv60z0h4sitPThriU7St/DNGqwjRT92SWOPI/+esTCml:zph4sCPTh+UE8iS92ml

  Score

  10^/10

  lokibotbootkitcollectiondiscoverypersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2