Extracted

• • Target

    2177e23fdb0edf07b9390bbc12979379_JaffaCakes118

  • Size

    328KB

  • MD5

    2177e23fdb0edf07b9390bbc12979379

  • SHA1

    7e7d208af5ecd7e1f66f6cc7e410703af666bdf4

  • SHA256

    b104c6fe931b690475af8136070db62905cc25d9e7713ca5d6d38651e7e179b7

  • SHA512

    e98fe87f954827b7ebc427f4380927cd4664724a661e97f614601c44d6a999442896218664fee3d8ef5c6119ffc82828699cb13468db8722d7ee2e47e6157dfa

  • SSDEEP

    6144:psE3WpQMV/0dfoXvXAa5EQJJf2dKhbrct9lx7lm5b7TiOxU3RUCjj:psFQMGqfwkDaKtovMltq

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Beds Protector Packer

    Detects Beds Protector packer used to load .NET malware.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2