Extracted

Extracted

• • Target

    051934711120beb60bd299a7e133e3c1_JaffaCakes118

  • Size

    270KB

  • MD5

    051934711120beb60bd299a7e133e3c1

  • SHA1

    4a6cb4af8651c42cdb0b9a276bfd05ff502f5255

  • SHA256

    7bc0f4e51796df68892ee16a279b6706e88f87809389641075e2a5cd76c1323c

  • SHA512

    186956ec094809b020175e9b916ddec01ec89636dbecac2e5dfbda885fbcfdb19a76f1279ac4fc7714a71175f05309c8814d156275c100e7ae9f1d832b51dc06

  • SSDEEP

    6144:8go5W9fsHQFsHjZK43aPFqXRFRTy4zBS1R/1SN:8go5OUOSK43PBTBzBS1R/1E

  Score

  10^/10

  lokibotsalitybackdoorcollectionevasionspywarestealertrojanupx

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Accesses Microsoft Outlook profiles

    collection

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2