Extracted

• • Target
    688ad92c68bbd4d9749ffac234552025_JaffaCakes118
  • Size 249KB
  • SHA256 df48104c58d57b4c37724ffc8d5dd9c438f9e88e894aa3b72d9ba205b10fe160
  • MD5 688ad92c68bbd4d9749ffac234552025
  • SHA1 aff2ad06483c9453f7afd07f4b1e1a41f3d69c63
  • SHA512 305c7a2ae6d0eb6bde04d369722c7b802391c8c06a1afd06510a77603b93941fbe07fa18c869214633ba81e7a8189f3eccfc3738517a3d33cdcaf9c998348213
  • SSDEEP 6144:F8LxBsuL14KEHt7Psi37MMnEYrbIDJzHLOHG+Ycj8vX3lTaHd:/MKLMMn3kBraIcj89a9
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/ipesa.dll
  • Size 17KB
  • SHA256 081284ebf71edf74989bf099d886dbaba27f2460d2ac40b2b67be290731a5dce
  • MD5 9a7251255f2796cf274ecc9934199af3
  • SHA1 05863956a21674d333c111e94a70c52ac6224fa1
  • SHA512 6f23e0e3f625c5f5d1e505710e5cec552e95b5a17f51dfa41f077a56a2087886aef0cf38742d3c16d8eedab90108e98ccf9c9e2c734ce551aa14097ef83d9c23
  • SSDEEP 384:DXbRaARrkAI7PjOddr121ME7mKN2xm9SVoQ:DrRaAVk4dk67KN2CS3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4