Extracted

• • Target

    bed69336c9d685ca16f4c885800af20a_JaffaCakes118

  • Size

    646KB

  • MD5

    bed69336c9d685ca16f4c885800af20a

  • SHA1

    82b9ff80947087306dcfcf03c46cb3aa824d959c

  • SHA256

    b962e30d9da3d61ebac158eb5dbcce9dfed9169757f9c73e41c4c33b0a4128bd

  • SHA512

    84668e06a4fff101bb59ed06fb29fd60e3dd916e90ddd8962c158ff1cbcdb17bde15bc327fa36fe49e06ce69ba048e4ad20dc1d50f0f8f2518f52c230e71624e

  • SSDEEP

    12288:eWB2RwgQb0IAtdN4vTWJVP7YkgBqeTzhBJqTi2h5AwCekiBjKUauDnu8GllotsCP:LYwFbyfNcTWzPRIzDJpcx

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2