Extracted

• • Target

    d0ebdeaa4db8ba653d9ec57708bd20c9_JaffaCakes118

  • Size

    877KB

  • MD5

    d0ebdeaa4db8ba653d9ec57708bd20c9

  • SHA1

    6922ed899f21c8c7bc42e4abf1dfe9c6fc954034

  • SHA256

    5debb1dde76910d16dd75e801a3ff1a4e7d103162165a749f590a52609ecad1f

  • SHA512

    3421308906c425278c1ede1b85fdfe3641f5b85bb8282ab8c33b4b6135caf9770ae2de6c1d3bc856167d94166b8853001bcdaccbcedc62470b44ac8aa56c08af

  • SSDEEP

    6144:a/FEK5qtJgd6vyZdcMO42hN1VGPOORSuzX7QoDKgk8PB79UoB/+F9cLRkqV+mC7R:UF5SwSuzOgtU4wudqOdWcBO8VGbyot

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2