Extracted

• • Target

    fe9d69fc9e928e62df311b6396286656_JaffaCakes118

  • Size

    884KB

  • MD5

    fe9d69fc9e928e62df311b6396286656

  • SHA1

    f79d97050e3b5898c476d4b8b08002a58cf96baa

  • SHA256

    4e96ee3b819f6b5e357284a6a401efe0ea7a3307d35d0d040452780a472dba3e

  • SHA512

    1ed5afc1e1fafa529630a0b1adb9c5e1922de30344bfc104208d9a81e4980505d483f605eab477686b7ee0a02a7a61564671acf6361949c2d15eb8753acf2663

  • SSDEEP

    24576:xIRIlfARYEpsJO7oqmxVSxStXIVpdFmkP8Io:n

  Score

  10^/10

  lokibotcollectiondiscoverypersistencespywarestealertrojandefense_evasion

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2