Extracted

• • Target

    2a10fe91801fe712dc3bdfac646b1874_JaffaCakes118

  • Size

    824KB

  • MD5

    2a10fe91801fe712dc3bdfac646b1874

  • SHA1

    c8584a9aa7ef4798693323a2cfaea3d2e5867647

  • SHA256

    34e88e5f9aead911aed80f5dc9d8ef9731b7281435cc6f74cb030ea0e3a45581

  • SHA512

    1586bfa6962e87f5cd6485baf0a117b3466383cced149a971e57adbfa37fe8559fadde5d6bc4a6368b81b53fb30cc3a97e7690bbf08b36c1202bd507d5fae758

  • SSDEEP

    12288:Ety66RCu0idOXU8Ln+KJASMGt6swf7VcEpOkRzIXcwAOcw7a0UP201eYSniSWgFd:16ICu0lX59ASMGosyrg

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2