Extracted

• • Target

    a57c8c146683defc5dc32fa9d0e72d41_JaffaCakes118

  • Size

    493KB

  • MD5

    a57c8c146683defc5dc32fa9d0e72d41

  • SHA1

    1c310b553894f48c13c82ba760b6bda85628a37b

  • SHA256

    078464bc207ef16ae3a3be2af1b44db1fcb618e535fa70a7edd8d3280a847f01

  • SHA512

    5de8aca8533e6594dfeef6dc0db1421a91601143bf713888ab1f55577e65bb19246340873197840a280e1689768f64e60ab69e4c120640a9ff33f1c53bceef82

  • SSDEEP

    12288:SohvQJ31CPLx7G3qsJRpN3l5wYlMNPaeGGxmpqg5RQO3N3:FhoCLZG3qSFluYuPaeLmp/b

  Score

  10^/10

  lokibotcollectiondiscoverypersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2