Extracted

• • Target

    a7e46470a8dc38dad75ce82bc0a0df68_JaffaCakes118

  • Size

    604KB

  • MD5

    a7e46470a8dc38dad75ce82bc0a0df68

  • SHA1

    5a1e70d8c68ce445bbe5f06a97f13bddd621f973

  • SHA256

    5b46483a724fa7ce85a59dbc18d3c4994fae183a778db9452f0fd443d9f369ab

  • SHA512

    d1bd7a3061779f9cb465d3ca6976f805e5428f2b5e4389612567136b169fbd99ad4ef75ceb37d45431f5ac91fd4eef495b05ba3478c65d5bddaf15a9ead1e673

  • SSDEEP

    6144:yNAR3hk8i5iucP6eP9BcFZIf8gEW25CBUTHKXNvVyHU6cCZcG42MBwsWqcpxJ8WZ:yOjP6eP94bgEX5ENtyHDLMBws3Wlcd8

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2