Extracted

• • Target

    8403d825737cf0952867d3c0dbed604c_JaffaCakes118

  • Size

    355KB

  • MD5

    8403d825737cf0952867d3c0dbed604c

  • SHA1

    743e12658871907d28535b80b6b41d736673a826

  • SHA256

    cb3a19cf173087ef452792132d20f81c9ad14c022a8a34f5b9f18eb923752397

  • SHA512

    7a8ca5f517c295b6548782da201f1210c5650713d1660e9218e6ca8eb7556d923c3ee540a59b0b77a1f8f18dcc9a22c209bd88be40e55a759a73443ccabf2a97

  • SSDEEP

    6144:tDGmKn/M5vndqvT+PNDoTnYb1Ta9Zbxuy2e4bRK9N2CTwTdoii16lxG6Mzws32z:NGZwFqv6WTnYb1apxuXK9N25lv4ws32z

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoverypersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Modifies WinLogon for persistence

    persistence

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2