Extracted

• • Target

    JaffaCakes118_220f2baabe01ca476a693ffe23418bd1

  • Size

    619KB

  • MD5

    220f2baabe01ca476a693ffe23418bd1

  • SHA1

    8a4ee94cfdedbe5e7d45c26f77329b09bef7be7e

  • SHA256

    602ca657348653f3ec1e2ace0b2f0a14b3b0ba009bf14c0ff96de46e238d43f4

  • SHA512

    17eee7eb59c3c102f52867b7308ec3d92fcbe67b6035319a8c09412b4d5ace49f952206c8fa7f77d181b0762cd2faae5f407e8acd43c05f85f596d925fc37a39

  • SSDEEP

    12288:eRUfZw2kLi2HbAyreUBg8qQaj3BCuROYL:e4w2TryrQ8qQ9

  Score

  10^/10

  lokibotcollectiondiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2