Extracted

• • Target

    754cecba9022cd223e85616a62e55048_JaffaCakes118

  • Size

    683KB

  • MD5

    754cecba9022cd223e85616a62e55048

  • SHA1

    893ef3f24fc567ceee6c26ffff8ccdb89677e6fc

  • SHA256

    ae5613f24c71abd3b7e9c263bb37eaffab6c4b859e2264709f31e4db88df803d

  • SHA512

    5fc59afaf949946adf911552b3a150ba8ffa4ebec9ca3d90b8de875043777f22a98e440f524878595120385ff7f5b7bf5c59945b501a1bf674369bdea62a8d9d

  • SSDEEP

    12288:xEz6HK7zH7vXOXfJG/101DOky96cFNvy2NHSevEPs/i8Y9BWXR:mzpT7f2JGd01V46celpPs/w9w

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2