Extracted

• • Target

    ef3689969af4c41e79f25d74183c4dfa_JaffaCakes118

  • Size

    961KB

  • MD5

    ef3689969af4c41e79f25d74183c4dfa

  • SHA1

    11f8f47a92e2518e5bd34dff309bd2971d2a00ca

  • SHA256

    3f13e3e2b89387134598d467a4d4f79b1eaeaeaba9b81ccc3d15f91471440748

  • SHA512

    2033299421acfe0799e249ca97955b87193f3f0578abe53a068a9f3ebfdbcb69f6c8f7be6220e63020306461fdc598114bfafd6c3ae12984d10caf7ebc239f0e

  • SSDEEP

    24576:ZISraiZ4BI8VA6h2Fnl4DEAQuaGhWV/Nm/y12Nhmx6k71Wzm:ZI0abN84DldaGnyYs6kgzm

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2