Extracted

• • Target

    e49131c91b49a1473ff9d93d7a35d5a8_JaffaCakes118

  • Size

    507KB

  • MD5

    e49131c91b49a1473ff9d93d7a35d5a8

  • SHA1

    deb0b7c3d797133e8cf018a9788666bf2ecefba8

  • SHA256

    d5d66c62abb9b7a8c80feeee0306f9cbdf0e4a5f2b992231c23ba75342f9d017

  • SHA512

    240eb4b6380f0efa489aea3b727957ee96324986812fa628c9fdc74540330e0548bb7dc80ce60512b1ad36fa8b90cd4ff13b7712c46bcc95a25853d2d6d43b8b

  • SSDEEP

    12288:0SnS14BdT3F8kCRPN5xRDmUK5E1natYWSytL7lx:0EY4BngrvRDmU3NWp7lx

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoverypersistencespywarestealertrojanupx

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2