Extracted

• • Target

    3bb34f3509f0dfe5e8bdb15a75cff5c4_JaffaCakes118

  • Size

    877KB

  • MD5

    3bb34f3509f0dfe5e8bdb15a75cff5c4

  • SHA1

    624fbb38849ec52a0c168075b78f4bb75260d04d

  • SHA256

    6a7f81b90c5f5dac25eae27575dba58a5e92d7203ff81e75c169003f2ca688d7

  • SHA512

    09e3e065033abbb0bf9c2de12d75f02420d5ec2846245caca9e537b0d3b27df7df7f6b34b7b23f37d49e2235232d518012f180365cb15dc2b5c8ec62125f6946

  • SSDEEP

    12288:6Qnsb4pvG0W/9bLZ+tIgLKV1VTdiWk11jTWASiGDhGB3Xe8R4SwZo6zgDP6QGSL5:33ifZtgk1VTdizybiO1q

  Score

  10^/10

  discoverylokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2