Extracted

• • Target
    jaffacakes118_Trojan.Win32.Delf.epxu.ca80d79fb5f8921ec4f6d0745144657d
  • Size 2.6MB
  • SHA256 c5129605405e236a2c608111001088c7f5a256991a480de174b8dc8bca77d2df
  • MD5 ca80d79fb5f8921ec4f6d0745144657d
  • SHA1 2854235066a764ba7c38b06823174bfd1bcc052c
  • SHA512 84e329eabfc95445642cda455ac6d711d5cedb15f048ebce1688b3fc9989284d3e292da99926a04abef227a81d3ab1d0cc4ee3bcedd756ec1d44c03c2b25f651
  • SSDEEP 24576:ZeBkKfg49FLqBo5mekai/HNRyW+OHl2b+l9B+dFtRstrHA1DkAFPdbBEzM1miYys:ZXiEek1/63QFV
  • TLSH
    T18FD5AF17D7419CF3DEA20630260B577DCB59FF481A4CB9836F64BCC9E6B081728A758A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryimminentlokibotpersistenceprivilege_escalationspywarestealertrojan

  • Family: Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

    trojanspywareimminent

  • Family: Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  behavioral1behavioral2