Extracted

• • Target

    0de45b6b06da3062434319df3beb8d3a_JaffaCakes118

  • Size

    365KB

  • MD5

    0de45b6b06da3062434319df3beb8d3a

  • SHA1

    fd4782a1eaa677888e7f652dc79d777d312901b0

  • SHA256

    485b6f63100f76e0e4eb9c46f8a98823f47ca8a19d38fd7e95f7056413807f91

  • SHA512

    f17e4e6d956a8a6a26094ae1fb66dd98745bccd51aa8cebcdbee705f62c0542813d492e20b3fcf2d1c2312c4811f47369cf984f41268dd4fed3fc0ed95f427c6

  • SSDEEP

    6144:/uq2uE3WpQMV/0dfoXvXAa5EQJJf6AQQXt3qy+00bRxU3RUCjo6:/ZFQMGqfwkDhgH0StB6

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Beds Protector Packer

    Detects Beds Protector packer used to load .NET malware.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2