Extracted

• • Target

    15458418d8327e36deaf27b44ef130ff_JaffaCakes118

  • Size

    676KB

  • MD5

    15458418d8327e36deaf27b44ef130ff

  • SHA1

    86569ce90fde2f4d7c9df765bc4211c5d8745391

  • SHA256

    0c26809f50f5349e7270d6a183a509a37356ea6109cced6f723236f86ae03a98

  • SHA512

    455df069e9fe73d1ad954f51e20b1b351e61cbbc19420372e30a6782c913fce0e91b80436aaa376b66be87fc67c0701199b922c46662ce617e782a97c139fc71

  • SSDEEP

    12288:2fJzgG7TY76z6hGUOirIET1+6lHwqh6QFeH0sc2lnrZkts12ynvec8c7Ni5sPQmO:UzN6YktxTH5H

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2