Extracted

• • Target

    c8e9e658f5b14994e2eb9085bce2767e_JaffaCakes118

  • Size

    509KB

  • MD5

    c8e9e658f5b14994e2eb9085bce2767e

  • SHA1

    61e4e25c673288cad9d6d6c42663b2b9bbb36ac2

  • SHA256

    f76346098898a9dd5c8fbd9cf498a95786bc22a6a83713040d029276ac276759

  • SHA512

    91832fd9059b9f35318ac1aa508c5c368427d2909faa1dd492998d0e4da5fa7bb135a374fc8fe9854adf8f88cc7eaeff75ca1acc18cdb8ad2918ce0df1b99738

  • SSDEEP

    12288:UnTYFYPUHkBbY0Ky3NavCVk0+qMc769k:UTblbY09P+qMK6W

  Score

  10^/10

  discoverylokibotcollectioncredential_accesspersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2