Extracted

• • Target

    9956722fe5f98352b36941cfcfff9db2_JaffaCakes118

  • Size

    1.4MB

  • MD5

    9956722fe5f98352b36941cfcfff9db2

  • SHA1

    01f5b5303f5f650757ac6496425d84fb9d099114

  • SHA256

    be7cef79a8b6eb0c852904477dc32cd4559edfc392d6976ea4a37ffc9b4cadfc

  • SHA512

    758e0fa437e8beef4672694732ead78cf4ec3290307eb4511a096e4881394c247e20b84a0b68717e6bd75aa430fe42f9ec275d41951cfeb119fab57fe07e7a53

  • SSDEEP

    24576:sOsSu6ZEgVBjVzqVBlOjOEr7J1DZfx3LCkwN2uEYY1pSlr3DV8bxOpwBg3Nv:swDfx3LrzYY1E9/d

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2