Extracted

• • Target

    5f7627ff044fb804dcd96d1673ad7f28_JaffaCakes118

  • Size

    628KB

  • MD5

    5f7627ff044fb804dcd96d1673ad7f28

  • SHA1

    ef3c37ba23cfdb641ffe2d717cfceb6aecba85cc

  • SHA256

    e15be680e14369cbfd92daeb43f53d7ea36e13e6c5ffbac830dab24cf0242b79

  • SHA512

    497789e0c545c370a3d9d48ba36b5d05d6f5a71970b6d04110bec324504ed777e49c1a181c56a6a160a7889892b080fb36d76d62761293d05bdd3d87472b5621

  • SSDEEP

    12288:EbQ+X8+UiDLbRHahlUH1lNt5774+SR8m+6mXv9vN9ccRsn0Lef:EbQ+X8+UiDLbRHahlUVPLngSmW/xRsnd

  Score

  10^/10

  lokibotcollectiondiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2