Extracted

• • Target

    68b61b94d1a33964d58e55ae52f78b9f_JaffaCakes118

  • Size

    340KB

  • MD5

    68b61b94d1a33964d58e55ae52f78b9f

  • SHA1

    bdaa3eac03377048c394dae69d56b5c172fadcdc

  • SHA256

    be0003c78d9e8b060ce147b159f4eaa6422d6718c81eb2cf311eac7cb2c2b0c2

  • SHA512

    7972b153e84bd618ce5b5414be4c64a4f6ba676d4636cc43723ae103bf92b491d7b9fe1d6d2de832e5e502d1fdac22ad16cf38cfcbd3dda375ce40ddaf05f494

  • SSDEEP

    6144:0oAuPFuFVNcy4zoGg/iEMgrJ3rICT1pfzBwV7d:0oVuFfh4zzgtZrGCnbBc7d

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2