Extracted

• • Target

    64284a2087bf0cd17b4f7391b4e15f99_JaffaCakes118

  • Size

    596KB

  • MD5

    64284a2087bf0cd17b4f7391b4e15f99

  • SHA1

    804525fd688201657c3c96c5722c1b5dd4eb34c8

  • SHA256

    f9ad9f2cb7edd7695a961472ba0e67695530e98e0b81d1be4880dfe383486e5e

  • SHA512

    ba3f12fd08a0883b69b7585003bd03a48bcefa5433f96c91aae157ded66e10a2f79365d93b6fc2cfac147c94b1b4aa80766b303f48380be0ad5c553277fa6522

  • SSDEEP

    12288:qOOs1KJl6G0Ku6HKDJEq/y6INX6LRgU7e9uNSEl0S:/xckGq/wKgD2

  Score

  10^/10

  discoverylokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2