Extracted

• • Target

    c592821051b07e4af5feec961b50d0a0_JaffaCakes118

  • Size

    8.2MB

  • MD5

    c592821051b07e4af5feec961b50d0a0

  • SHA1

    d5e95017b87e390ab08f4a8566b9f79b9a76f6e1

  • SHA256

    3d168d9923821e7ff7e1a7513bca26a9a5ebb0e440bdc3b7f9c9a2f5b8fb79b1

  • SHA512

    037689468a9ac668a876c1a6cb8fd68fd7a38ec35bc88d8f6db4a702015c7e6c7f7bdcdeec3b203f01bce80249a4327f01655b1d163956bdd3e49c30db839bf9

  • SSDEEP

    196608:Is7D1VO9ekvZbKjLJ6pMUZsiufjKvdOPMKnQnxO3iO5xEZPOpg:IMDs6JY/iQdeMM8JO5RO

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojanupx

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook profiles

    collection

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2