Extracted

• • Target

    60c56b93bbc84ff7b15396ddf977cfcf_JaffaCakes118

  • Size

    378KB

  • MD5

    60c56b93bbc84ff7b15396ddf977cfcf

  • SHA1

    57778384c4f1cddf55c2d7acacf2a66559668871

  • SHA256

    645c0709512e3abe9794777c7b49ef75ca1b698fbeff13642da042b8c4def95f

  • SHA512

    60e745e954c316530df19102f3ce74a7778a96b809fdca3c57c788609a35feaeed628e6fd8781a06d717e64582fcf9d4c7039164b760298c9a3d14022e63ac2f

  • SSDEEP

    6144:8z/eEdaP4dd9cxBLL/nAdhmpdZdoFcVHhCexQBre/wKPzKxSy4vDTf6M9CmAr/pj:q/eEdaP4eLL+hYdocnRys7z9BsH

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2