Extracted

• • Target

    d5939c8c1bb766426cbde9b0a55e6dec_JaffaCakes118

  • Size

    631KB

  • MD5

    d5939c8c1bb766426cbde9b0a55e6dec

  • SHA1

    9aa4ff8c7107373c1fd74adfe227dd1150545d87

  • SHA256

    3cd0e5e72868d42ee787746bbe71a01001779b824daf3346d3cfac2a308d2089

  • SHA512

    7d8376c5303f0542136ea6b55455dc60869be12c2cf7017fbc68c263056a73676bf17a58c13662aaf16165f75b845c680f08090f1d45913539a662b31706005d

  • SSDEEP

    12288:DLL/HK7zqPVKdVVxDqy5nmLqAeG3q0qAexEYwYBk2eXM+6I8YFZ3zGjot/0Gz:u2dCDRVReq0qHxEYwYbeXn0qlSotcG

  Score

  10^/10

  lokibotcollectiondiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2