Extracted

• • Target

    c87ffeae4e1c58fe6b697633ef6f5d72_JaffaCakes118

  • Size

    492KB

  • MD5

    c87ffeae4e1c58fe6b697633ef6f5d72

  • SHA1

    0f0524589728e5582d59e6ac7ff9ace1d25a09ce

  • SHA256

    617bcb8bf23d21b2ec967dfb558fa05143ac8e1dcf3e6191733b2d29bfe9536b

  • SHA512

    6b322dab3680e9dacdc57f3fb4a1cd105f0e7545526408796e81fdbe9fcf41061ddf80ac2b91150054d6ffe11c8daa3ab4273d448b97e58c513ff8ab5e0483a7

  • SSDEEP

    12288:rYV6MorX7qzuC3QHO9FQVHPF51jgc3OP0g0xbxRfjGVh0:IBXu9HGaVH3yz0xbL7g0

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojanupx

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook profiles

    collection

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2