Extracted

• • Target

    a0531de70124e0d6e9fa5483b916dac9_JaffaCakes118

  • Size

    1.1MB

  • MD5

    a0531de70124e0d6e9fa5483b916dac9

  • SHA1

    6e05146b4c5e3a1061dabd8043d1b3520af3d017

  • SHA256

    89818c7b036b5d5a6e90ea30a8c96636db1e3f0db4cc9b16e7f130dfb15bfe79

  • SHA512

    77cfc36ab859352e39aff3d0dc5e07ad7cecde07ee72500a118ddd088d3536cf30a471f1a176d3152694daf63501d61c9bbcbb551d732aeba890e621a4933251

  • SSDEEP

    24576:fAHnh+eWsN3skA4RV1Hom2KXMmHam/Rmt/D/HAX5:Ch+ZkldoPK8YamiD/c

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2