Extracted

• • Target

    94f4feadf51fb22e3fb7b0c1c8d386e1_JaffaCakes118

  • Size

    350KB

  • MD5

    94f4feadf51fb22e3fb7b0c1c8d386e1

  • SHA1

    af872e59f9bdce5524f61c19db8e9f8fc6eb7b15

  • SHA256

    d5a9fd3d71466438ec2fc64db151615d109550d7e054f6418d11440eb08c6f1d

  • SHA512

    4dbccff855851320211bbceb106fb118ed2636b8ff758aa8d5efad66388d96be53de58e6f5d3508e42150d3a8ec91965ea1dc4bb8db9938da0b2cd38ad658cf2

  • SSDEEP

    6144:52kYMHGE6rv7Z1BvCd7WAZhF7UmtOTqIaguh0yXZM9TYkPp1wBr0WzNKWIw:e4ZE0OOlJpM9JxOBX5KY

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2