Extracted

• • Target

    cf0bfe3a2d5588e7c32db4f248ce40a8_JaffaCakes118

  • Size

    916KB

  • MD5

    cf0bfe3a2d5588e7c32db4f248ce40a8

  • SHA1

    aad6eb25691d3878b3bbdb1799a83c2f98e85d81

  • SHA256

    a81c3b9306151b1f9406703bf5d52ce46e05bb96b43844083a9fee6876c1a990

  • SHA512

    1b22445e2ebd6f33373d14e26daef237162ea7a6935bb35afadb1c6d1be15dfda1f81f775eda6c6db53a8437c3fc2231ca4df700bfa558b35e455a67bf1728bb

  • SSDEEP

    24576:D4DD0yqgSw2OEk4KpqzpXSA9oOXm9ZQn9qY:D+qgSw2OE/KpqzpXb9oa9q

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2