Extracted

• • Target

    d3274502944236292d9c486a333f411b_JaffaCakes118

  • Size

    529KB

  • MD5

    d3274502944236292d9c486a333f411b

  • SHA1

    77f7227826685a63e2eddcb008e6dcf19035f8cd

  • SHA256

    29d773d15761c4d54edabdb7f5f165d8a111c001da73e412e4313140e13aba63

  • SHA512

    8c797c613c437cbb2d7a3c995749dc6a929bedbd3cc6996a4034703f547a42fcb9c7bac5fadb8852f4d26fe184964128d115cc4ffec489d97d73d4725108c4ea

  • SSDEEP

    6144:AgmXLE8laSrBvqUZ2YmLwE7yZZdyUYu1I9GlXOB8Lb6dscLV735Zg8ionw:oXtB1I9GlVLb2R3Hg8

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2