Extracted

• • Target

    c661e6f45eb379feaa96f165b3bf255a_JaffaCakes118

  • Size

    498KB

  • MD5

    c661e6f45eb379feaa96f165b3bf255a

  • SHA1

    ceeb07862ddeee88b61146007375d517584c883c

  • SHA256

    275c247709cfde6339f444b9386d64cb8199378dec6cc20ab2452df375531532

  • SHA512

    6798e31ec52bef5bf502e17e7ae124d8d1345196d8e3369cb1a29ae8a5e42e28e639b465866fad3c6a53ba4945d7c59b75964d281223feb237c7712107e87918

  • SSDEEP

    12288:eV0n+TLGxS6kORFtH92tKyuzgtv4i8+iHWEyq:e6e63RFt4Yyuzgtv4i8+i

  Score

  10^/10

  lokibotdiscoveryspywarestealertrojancollectioncredential_access

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2