Extracted

• • Target

    654cff8cab6eb335e768f446e2bf31b6_JaffaCakes118

  • Size

    261KB

  • MD5

    654cff8cab6eb335e768f446e2bf31b6

  • SHA1

    36cbebcd5a24da40492b0817eceec968734d21dd

  • SHA256

    6b316a9219cbb0b83a1799bb1a324bbcb3f379c90f5096ed5a28a2020875488d

  • SHA512

    54ace2b43cc55e09e02cd194aa1be544c5c83d73bc070e4afa8f386b8998442d479a413680658cb34c2480664cf6af1cf0a1e0dceb7f61c6eb67d02170ab51dd

  • SSDEEP

    6144:fspny4P2kffDv7umgzPnQDFbvUl2xWLS5NMCQybOzE6NddTgJGjUgBqkOFgbN:kpJfDzumkPiFbu2xusNfbPGjROFQ

  Score

  10^/10

  lokibotcollectionspywarestealertrojanupx

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2