Extracted

• • Target

    8337d48e68802bf418a2e00283ab1914_JaffaCakes118

  • Size

    297KB

  • MD5

    8337d48e68802bf418a2e00283ab1914

  • SHA1

    a4b29f419c3f1cca7aee24cff1ebb10416c18695

  • SHA256

    1251e556fd7af5f92ba248b630393034278d7ee4fb0a7732593e0b3bcae0189a

  • SHA512

    a7f067177bc7caa805b3ccfbbe24dd78c1640581788eacf838ff8b4929e176884f1b9914c172b92099bbc50896eb33b496cfe3d5bd49ec7cee3f6a07239b423b

  • SSDEEP

    6144:9zqg9R2sG9BfheFZemiJ2C4DVth4cLUvjj0hTt/9:9mQR1HFZemjRth4MwjApZ9

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoverypersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Modifies WinLogon for persistence

    persistence

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2