Extracted

• • Target
    9ebd85210f51d18862b5d197e73309f0_JaffaCakes118
  • Size 306KB
  • SHA256 b1a522cf1688c79e5148c41caa7ebf9c71f9cb0a87e3d2c3acd4a0e5f9c22705
  • MD5 9ebd85210f51d18862b5d197e73309f0
  • SHA1 d2c5cd6181532dbb278a13af5b563feb41fb9fe0
  • SHA512 6bef4c9c01c706bcf24abb06dfd60929319018374e4e991382df492c206d03d5562a3faa7219c403d0866d227a9bc83f10dffd8b055609127e8833cb68d4d1e0
  • SSDEEP 6144:JPCganNRhnecKgH4G/ptftDbNZRcZEpK28TqGH+MnY47Z9toVk:Hanjh//XNNZ2ZeqH+8H19to2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2
• • Target
    $APPDATA/yonetici/agent/ht/ZipExeStub.exe
  • Size 26KB
  • SHA256 0e1d1b6545d1162c755e0b22c97dfd337dfc64fb8791704a93c84d448b44511f
  • MD5 69aa866258d8c730bf1feffeabe57fa5
  • SHA1 b4a895c279b6900e60cb5e90cdd5a6e9b79828af
  • SHA512 faf62cd96aacf1a94d4e893e4ecad9f494ecc61f548f0b955f3f47405696c6b1ccaac4a3b57dd9a56cbf0db81b64a36c55fce31a983a26be5a66d41c9b1ed5a1
  • SSDEEP 384:BsJQbkxQ7ECMcxIHe7g6ihJSxUCR1rgCPKabK2t0X5P7DZ+uelWLwWfLCcMe/oTC:BsJQb9Mcxqe7FRJBOtL3d/o+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral3behavioral4
• • Target
    $APPDATA/yonetici/agent/ht/vcdeployui.dll
  • Size 10KB
  • SHA256 116d2a7b1c04779dc774f9012dff83f01cc4905bfce0e745c1e6f1b469b445a2
  • MD5 86e8573da0da08bc5801eeb05722b900
  • SHA1 9df15367a068e8f16bea5b098c1bc5ab0fe8f816
  • SHA512 bcb449de7aac0e68802868948344f57d7113eb16209ac8d2b5fd68f387c21998748763e34bc15cfb2ea3d9b09df4379eeac9b7651064a633d09d2ae6befaa724
  • SSDEEP 96:yOKkWxHSIWPpJG4yQMsn+WT74+olgDS8zlzcWmzIBTCT5o4nzkInvzUiPjP7TPmP:hWxyIWRIx+4+Yu7RS/I1vIQG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral5behavioral6
• • Target
    $PLUGINSDIR/BgImage.dll
  • Size 7KB
  • SHA256 c1593d641b89c8cf294ce4efeaea5d0a69b095f04947ecdabbef73d3225d3480
  • MD5 1f56d9c34643cc8033ec8e628df11cfb
  • SHA1 1231b571a298c16a1f618799fc7d20b72ccb2747
  • SHA512 a0c80e6f5c4aa6f34b601951033b709944d3522a6faefad11d9d8f1b4398d379d4e5618029c8134204f344e8a71bfff4e19c2d6693f2119ffd05e67dd9148d24
  • SSDEEP 96:8eU0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqkfnLiEQjJ3KxkP:tGBfjbUA/85q3wEh8uLm2LpmP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral7behavioral8
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
  • MD5 0063d48afe5a0cdc02833145667b6641
  • SHA1 e7eb614805d183ecb1127c62decb1a6be1b4f7a8
  • SHA512 71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
  • SSDEEP 192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral10behavioral9
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 8d4b1c275fd1cd0782a265080b56d1aec8d1c93edca5ef3b050d1d20d7b61f33
  • MD5 6e64e5d5f9498058a300b26b8741d9d5
  • SHA1 837ce28e5e02788da63a7f1d8f20207d2b0bf523
  • SHA512 f53514d36021d79f85df2494d403f03589b3ad848889b9224f962cc932ef740f127131a914c7171ad8136ca1ef631285ea1c80576db18ccf8ea56940eb00ea1e
  • SSDEEP 96:oWW4JlD3c151V1gQoE8cxM2DjDf3GEst+Nt+jvcx4P8qndYv0PLE:oWp3ggQF8REskpx8dO0PLE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral11behavioral12
• • Target
    $PLUGINSDIR/nsExec.dll
  • Size 6KB
  • SHA256 49b7477db8dd22f8cf2d41ee2d79ce57797f02e8c7b9e799951a6c710384349a
  • MD5 293165db1e46070410b4209519e67494
  • SHA1 777b96a4f74b6c34d43a4e7c7e656757d1c97f01
  • SHA512 97012139f2da5868fe8731c0b0bcb3cfda29ed10c2e6e2336b504480c9cd9fb8f4728cca23f1e0bd577d75daa542e59f94d1d341f4e8aaeebc7134bf61288c19
  • SSDEEP 96:4BNbUVOFvfcxEAxxxJzxLp+eELeoMEskzYzeHd0+uoyVeNSsX4:EUVOFvf9ABJFHE+FkEad0PLVeN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral13behavioral14
• • Target
    $TEMP/go/25.opends60.dll
  • Size 44B
  • SHA256 b407fe7ddcc7303ef167873a6498e8ebd771e9b4b432ad0a458a029574ca6afd
  • MD5 09537416318f379396bddbc18046de39
  • SHA1 dc6111549ff49afa587425603cc0c545b034b988
  • SHA512 20b9ab08d3e940d687404436e2d6c8b4c1a9121987382c6253d7d93fc2b556fb8780742af08d8b73e4d50ea9b23d2e62298669650df60ed38e6f23c5c0155619
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral15behavioral16
• • Target
    $TEMP/go/35.opends60.dll
  • Size 57B
  • SHA256 99e399e564c46308a2ec22a427f5338433a820c09ff559c8f6488be9199ed1ad
  • MD5 b330e04d27f2b76246c9401bb9df8405
  • SHA1 fea5928cf1704d14ee717bb703c65aedfb194751
  • SHA512 b07555fa3fb5e11e91583c28922f5a59f09e0cc8244b3bc5e62cfc231cd4a4da080f0653d404ca9a8ab332f61e393ed17235858e84dca0578f8ae51e9b5f30a9
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral17behavioral18
• • Target
    $TEMP/go/pidgen.dll
  • Size 39KB
  • SHA256 888f6c10d62ba7470fb457f054769e24a35edb86a3144214113b5a6472b0332f
  • MD5 d6daa21229600584d00093df481c921f
  • SHA1 a0848216ed5ddf3945938de79c746ce7424c30aa
  • SHA512 d0cd6370ee5bb8daad4f07a63bb16554a723ee0959bff447b0b67c41bb3f32404d1ba2eb219679498a55ea63204584f5c2fb2ae466c3d0654fa0e118069b06fa
  • SSDEEP 768:WGDpZQyMVVIDR4fUB+9RtYknN5EQmlCHhrBPsx1H9xllMGCacV:WGDn4KDOMET97ax1rcV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral19behavioral20