Extracted

• • Target

    110a31b6aada6411c637c33118215584_JaffaCakes118

  • Size

    593KB

  • MD5

    110a31b6aada6411c637c33118215584

  • SHA1

    023187c4ecbf3c580a9dbe06ff52d1a957e8c6f1

  • SHA256

    d9a989dca775cffef53b424b84f483da5ea6a763c180f53ae51a3d080ac936ab

  • SHA512

    a8606c147a052c19159836d3884aad5aeb0e8a637fc684a8a00622b4a9a3eec4f5c586a4f905468d187b9ba9258da83e6fcd847849c0b067f08aadd864ec91fb

  • SSDEEP

    12288:D+EO/HK7zwgkC6xHyKsZfMwE1bKwfKGwf7BVr7e2HriQYpwvAF6gCT:DJ8gGByIwE1uwfKGw1VGKDyVF6gCT

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2