Extracted

• • Target

    d34183be200632abb5b9e64b17b42d1a_JaffaCakes118

  • Size

    237KB

  • MD5

    d34183be200632abb5b9e64b17b42d1a

  • SHA1

    70861f024d28974f7953603a6f22f986186c44b9

  • SHA256

    87c2b78fd607e7b6a0adc5d5fe75dccda4366d1eb4b781e85195fbfb4d7940a0

  • SHA512

    7331e744bb4aa7b99b8848945d3d0ecbe8ab8c98959389c66422e433fa3c241f166e0f170c525f3585edd057f85df0de655f58215b71e1e6087f592b8f742d52

  • SSDEEP

    6144:VLojQyROKzv6vwDfWbifx7bLN/eKRZrQdOW+cWJfaf6TGyPuPyEes:VQQuzv6vwDfWbiZrJeKRZaO5bxa6Puz

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2