Extracted

• • Target

    9fe87ff4d31328429b33de345bb2d049_JaffaCakes118

  • Size

    542KB

  • MD5

    9fe87ff4d31328429b33de345bb2d049

  • SHA1

    ad312010e0dedcbc441be63d160060ab892a37e0

  • SHA256

    e828358c909853bcaa4d0ffe90b162392fb3982e25af33ed1d9613a343beefae

  • SHA512

    f64352ad25aadc3d0247b51e167d598dfcc78d2e73852ce14651edb8dab8a3b1bd8adf4a2869138b73ae1e39300c548a4882b2371343449043d20e6c43046ceb

  • SSDEEP

    12288:hg/jLWiLD3K8iHEmukAoCZ2ECbBwpeP8g:hg/XH6HExkvUhCbB1P8g

  Score

  10^/10

  lokibotcollectionspywarestealertrojanupx

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2