Extracted

• • Target

    d8183b18d7dc1cdc394014454a91e4cb_JaffaCakes118

  • Size

    364KB

  • MD5

    d8183b18d7dc1cdc394014454a91e4cb

  • SHA1

    392381bff4eca519fbb911e64c2bf3261a61c30c

  • SHA256

    156c81acecd97343d185ae41c40c5979efe98174909a74fccd28fd18dd1a50a0

  • SHA512

    d8a48b68001fb084d6188d831b43927f49edc36164c5646690aeea1d2c9af0eb2c63711bf8aeb09f0c9a74044c1fe070e2bc4596dea2b05c0876b3eec233f17a

  • SSDEEP

    6144:CR5vcv26Fl6THpknBRgbcddz798JyR/m56FGnugR6VLytC+yEHzJSf25WNs6K3RQ:JUbSBRgA/Z8JQ+58euBFwCYk/sX

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoverypersistencespywarestealertrojanupx

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2