Extracted

• • Target

    8e9c8277537740b44a376e0cc4228bb4_JaffaCakes118

  • Size

    2.5MB

  • MD5

    8e9c8277537740b44a376e0cc4228bb4

  • SHA1

    8c1f8f19db989d14a2fcca521a7f5f55b02dd471

  • SHA256

    326453649d249146c9d385d8bff8bd50bc29cd48fbac2e5cb2222276ce75f14d

  • SHA512

    c0f26dbcb4f1c6ec23fbf23fa885b587d0385225c858c88fc3d30ac3732446c5e7a4ed92076fcb3097f80e8c05a6b1db5b03e5a3911cb7983cfe1da389a29410

  • SSDEEP

    49152:SBoZ0ajbQzlq5O+l4QOnn8jeX+l8uvlhfNf5lWLPNyeL9+hw/USGy7Xk/51HwgGE:BX0zlC6mJ98A3NQ1a7

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Beds Protector Packer

    Detects Beds Protector packer used to load .NET malware.

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2