Extracted

• • Target

    688ad92c68bbd4d9749ffac234552025_JaffaCakes118

  • Size

    249KB

  • MD5

    688ad92c68bbd4d9749ffac234552025

  • SHA1

    aff2ad06483c9453f7afd07f4b1e1a41f3d69c63

  • SHA256

    df48104c58d57b4c37724ffc8d5dd9c438f9e88e894aa3b72d9ba205b10fe160

  • SHA512

    305c7a2ae6d0eb6bde04d369722c7b802391c8c06a1afd06510a77603b93941fbe07fa18c869214633ba81e7a8189f3eccfc3738517a3d33cdcaf9c998348213

  • SSDEEP

    6144:F8LxBsuL14KEHt7Psi37MMnEYrbIDJzHLOHG+Ycj8vX3lTaHd:/MKLMMn3kBraIcj89a9

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/ipesa.dll

  • Size

    17KB

  • MD5

    9a7251255f2796cf274ecc9934199af3

  • SHA1

    05863956a21674d333c111e94a70c52ac6224fa1

  • SHA256

    081284ebf71edf74989bf099d886dbaba27f2460d2ac40b2b67be290731a5dce

  • SHA512

    6f23e0e3f625c5f5d1e505710e5cec552e95b5a17f51dfa41f077a56a2087886aef0cf38742d3c16d8eedab90108e98ccf9c9e2c734ce551aa14097ef83d9c23

  • SSDEEP

    384:DXbRaARrkAI7PjOddr121ME7mKN2xm9SVoQ:DrRaAVk4dk67KN2CS3

  Score

  3^/10

  discovery
  behavioral3behavioral4