Extracted

• • Target

    ce6f92047d9c382e7ee7e4ec9c8a1ec6_JaffaCakes118

  • Size

    978KB

  • MD5

    ce6f92047d9c382e7ee7e4ec9c8a1ec6

  • SHA1

    7d696fc777cade7257c77381fa8e6b874ed8e7d8

  • SHA256

    504d0c278e73e891d33ca54f860b323f003d120284be3779975e9dedc3c5a132

  • SHA512

    095433e2a75cae3d0c505ec86984d115c37631291d9310a3d15266210fa8e8865e07db70b88bee0ebf39bde4d6f1e0a501b917d4f8adcf307f951587c69b911c

  • SSDEEP

    24576:z4lavt0LkLL9IMixoEgea3h6u1ckteyq9MmCS:Gkwkn9IMHea3h68r9aPCS

  Score

  10^/10

  discoverylokibotcollectioncredential_accessspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2