Extracted

• • Target

    4b3ddd9cafbbb288eb703182dae9fd65_JaffaCakes118

  • Size

    823KB

  • MD5

    4b3ddd9cafbbb288eb703182dae9fd65

  • SHA1

    169767d056176832639f8118ebb938da6a25c031

  • SHA256

    07fbb8d2038afc0b03a2b89082693597a45a7e5f75d065c919fecf63e386c58d

  • SHA512

    df9c35609c6f4dc182ddfa31e3f1016a65fddb6b5615cc39e7873c295f617485227d5dda761331b905f2c7e0ada79cfadb54c4af6d0b27c1e9fe4240c42b92f2

  • SSDEEP

    24576:atKfPp9AR95yaRk+TAugGlWmiEqnAZHJ+bDHzfx:xPpKRyaRfZiQY/T

  Score

  10^/10

  lokibotcollectiondiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2