Extracted

• • Target

    JaffaCakes118_ef6feee9c72a7d0ed5e065631faf3b36

  • Size

    376KB

  • MD5

    ef6feee9c72a7d0ed5e065631faf3b36

  • SHA1

    7be1eb3872891aab4d513ff6725da77609b8e95b

  • SHA256

    e6dd5a2bbbaec7c7cc5d6c68070ceacacd7d364806bbe31dd365cf161a61d3c0

  • SHA512

    c01c707c4b46b5b4fad41ff9af09448a671c8540f9879e750af46c22cd10ee1e3356cb855b19153048ee836467c8484239f0eadf463cd758255920e318da3d8a

  • SSDEEP

    6144:q1nIWAkzEm1owGNmxNslavrY3bi948ipyZRr6EgS4DbXhiTaF9dCJL9mERt9RGTM:6IWAkTGNmxNkMY0iAR2TvDyL9pD3

  Score

  10^/10

  discoverylokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2