Extracted

• • Target

    e32f2da4822a77457dc27670c64e30d4_JaffaCakes118

  • Size

    305KB

  • MD5

    e32f2da4822a77457dc27670c64e30d4

  • SHA1

    d0e98a49b7dce7a901c90837c11ee4f9d117278e

  • SHA256

    b4fa2f0e7595f310b0a4467540bddfb93f2df81d2d0899b1ce92ce20c49acdf8

  • SHA512

    a3b709c3c3948cef221cd88fde4f8710f73e75808bee644fc1acae39b5fd3633ddf935e64faaf1ec4bf58006dcc38dc82c6a40ba779d151aaddf540aadfdf565

  • SSDEEP

    6144:r89tUiERQ+3HwO3JK41Sm/TK55yTXMqq82zY5OVsX3R4MuGwcd0:riESo5K4f/W5lmO+ABc+

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2