Extracted

• • Target

    8177fdfe86f0dc6d5baa83ee968788a1_JaffaCakes118

  • Size

    410KB

  • MD5

    8177fdfe86f0dc6d5baa83ee968788a1

  • SHA1

    9d13e6ae82c2fdfc9b0a8ac25fd693efc8d76aea

  • SHA256

    3df08455328e3a6d6baba03305f922e1f676bbdc33bd36a7b4cacbe7f12507d4

  • SHA512

    c6661a94e2a9aba1c2e53d0a9fc373cf169da421f88e4a524434b853abdc6ef4d1e4e899b807da9ab36bbec7a6ecd992bc47f641b07ae4e04a1301a32809e216

  • SSDEEP

    6144:QpbUwWKTRTdP0YKAuneGKxgkl4OoUXeIeLg5+kdR5uf:KUw99dR3ur+l8UXfR+kd

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojanupx

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2