Extracted

• • Target

    d3a8aaf9faf7464bd75e7518c4e38f7b_JaffaCakes118

  • Size

    1.0MB

  • MD5

    d3a8aaf9faf7464bd75e7518c4e38f7b

  • SHA1

    0e47f23fa11f07d6f9ff8f70a5391b7cfe303265

  • SHA256

    fb5f9d089d43ffe9ce57fb2cfb395fb7baa44afa91e6c564bec9a0e6c0cff73e

  • SHA512

    056b141a86777b140c23773efc1e34d3df2cb9d93b4a8d863dc28d64d6441d8cb15bed2dd1b776f91462a1cba4740ade238a51fb938dd201ec5268d09d9dd286

  • SSDEEP

    12288:JoIYY7brJlvMuoeiZDW4BNWIAN8sFh24Q65krLhhhhhhhhhhhhhhhQ8bp2vCQCRX:JtDnPvMu+lW4BsPzFBQhZbpdxQh

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2