Extracted

• • Target

    7aa1a4ed6b8776c2b2ba5c999c6a5d22_JaffaCakes118

  • Size

    648KB

  • MD5

    7aa1a4ed6b8776c2b2ba5c999c6a5d22

  • SHA1

    b30d9bb52aaa3024eec9a3c662b6e19265cc3cf2

  • SHA256

    bc9084e36a37d02f116740df25e23a40ef3902a3e2da11cc94861f5a71d31377

  • SHA512

    f2e164f190251795a4ba5758bfa8fd703e5df950b624a8efc2dfac95580159efa5b50c35f425efa0e0d438404cdaa8699918c0e21c97e20a08c28ceacbfaadea

  • SSDEEP

    12288:Fn95fBkDkiKDhab2TCvM6ZQz/pusP/7PEHOTDY7idSI9se5pZQcTc4bEpfpghVfU:R9xBZjw8CvVQrQuDmwDTVy

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2