Extracted

• • Target

    e6e617104652143d836afe8d61366a17_JaffaCakes118

  • Size

    519KB

  • MD5

    e6e617104652143d836afe8d61366a17

  • SHA1

    27afd3fc8aaa43b82a15366c05f8130a573aef78

  • SHA256

    3fb7fa64211d1a218fc59ad674642205960982542f9796cc792e983c8145b9ef

  • SHA512

    3a69f5719dc29f832484a2e413f0b2addd542c579c39b0fe300568fe25ce4e28777672da2d16469f4a0fe007f212056e0f4859b56740bf5b3fe06d313f6d8504

  • SSDEEP

    12288:FDPhnwaTe1Mx/MF3ObXAdnT5vzwDEZpxkS3d:xhnTTeeEqYlvOm

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojandefense_evasion

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2