Extracted

• • Target

    b23e00427c59cc280c1fe424d50980f5_JaffaCakes118

  • Size

    2.5MB

  • MD5

    b23e00427c59cc280c1fe424d50980f5

  • SHA1

    e526f198acd24cca2f81da0f40f495ddb64130df

  • SHA256

    f17530304a81626c9a6ba56c2bff09b611620d1664ed26566347a1309fc06692

  • SHA512

    34913bf5d14fc8e4156e831f1ae9eef6e28b6c7a5c07bff615bd4b04207bd7867d9e1a2a7aff7ebaf5f4a0face6745e73194c89d469a06c7c6ff4e9f296fe2d2

  • SSDEEP

    49152:eoZ0ajbQzlq5O+l4QOnn8jeX+l8uvlhfNf5lWLPNyeL9+hw/USGy7Xk/51HwgG93:fX0zlC6mJ98II68Q1a7

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Beds Protector Packer

    Detects Beds Protector packer used to load .NET malware.

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2