Extracted

• • Target

    add314817d2ba5280c227f548c4ae715_JaffaCakes118

  • Size

    729KB

  • MD5

    add314817d2ba5280c227f548c4ae715

  • SHA1

    4e5e581c537ce0de0ccee75f8e0d173db30f2df4

  • SHA256

    eab4efd7bc1f23a02e79b46224ca494813bdbb2e8ffd73c4417fa57493fb294d

  • SHA512

    5763e94e5175710b52f69afac318b8f51a23b127a87bba43f884f903c9aeda911fc81f7733637b900e462f015b8bcf5b28f5b00ea4430f6dd3cfb6b35a406e67

  • SSDEEP

    12288:BUO/m/79WECjNC7AEXTHxZBCt8YCOhXRvQoqXfRZzMI77/TXAjySHHObdbatVehb:mUX07lLBCtvCIRvQoq3H4

  Score

  10^/10

  lokibotcollectiondiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2