Extracted

• • Target

    7526736bf28f79f6ba947cc03c6fcd50_JaffaCakes118

  • Size

    411KB

  • MD5

    7526736bf28f79f6ba947cc03c6fcd50

  • SHA1

    7dd2bd7e2008e38358fa2a0e9f398faf41ce97d1

  • SHA256

    df72fc36385e126949ac79802518d9aa8c2fc72c80fd70e6ed50f4484e1b8b53

  • SHA512

    e4a6d540962871b765de219552b3bdf3c9a8c5c2d775fe50d032971fa4cb8988ee4ce418570eb4b7188ad2643862e6d8d745f98d2d677dab6576114bc5e0713f

  • SSDEEP

    6144:6teU5EzqJeWFgwvLkIeRykKnH3wgHz8mZX2p0apdWUUGkPquTuxkOcyr:AexOJeWuIe4L3w6rl2H3cqYux

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojanupx

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2