Extracted

• • Target

    d6b2096db2eb22ab929b576ae402c83e_JaffaCakes118

  • Size

    381KB

  • MD5

    d6b2096db2eb22ab929b576ae402c83e

  • SHA1

    4fb837fb092367b9f2a64ac8f5268e594eb18683

  • SHA256

    3c0be29b239ac47fd813a15d7b03da24ef94028da46a6efa3573f2d5b4d06f19

  • SHA512

    cf9b1428ed7f21956d677ad56260ab3ea0875702b8f8d327a755a4099985df8d57fe0984a5db4c34fa859965d08ec34c474aa6f22d53df596707fcf8e0b75844

  • SSDEEP

    6144:BNBvO2xkG3q0EP2oTsWOPK8DfOEiITFmr+/ZS5TPhPJfQVYtoMsOWpoku71/FkWC:LBtxkG3nEP25isfOEia8r+/ZS5TPhPJC

  Score

  10^/10

  lokibotagilenetcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2