Extracted

• • Target

    cd86cb493731b80b3d24a7fbd800efd6_JaffaCakes118

  • Size

    521KB

  • MD5

    cd86cb493731b80b3d24a7fbd800efd6

  • SHA1

    c8b89e27c44ec82e2ac841f2d55f1093168ed4e3

  • SHA256

    e92d07fa99281bdc721fb92f964fb5b8b6fa712bc4241bd5aa7e82b2c2c8551d

  • SHA512

    f6681f6102c472d50dddd3c2d4fabd68bf71c295450382a569e6ba264fe1dc513b4eb2137f7208245cde965bf7888f4f7cd3adaa6fdf6e5ca485144b749ab3f3

  • SSDEEP

    6144:UCdK6Srtxx81k3hFB1sx+nQN0wYMEoMeQCjFRHIYlWnDEjwFb9A3lZiqsHuXZ8QM:mtxx8GVssOEoMaFRHIFnDUiiXZZo

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoverypersistencespywarestealertrojanupx

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2