Extracted

• • Target

    e89cb61349a6bab43f582b9087283007_JaffaCakes118

  • Size

    1.1MB

  • MD5

    e89cb61349a6bab43f582b9087283007

  • SHA1

    5c212383197a2eda5c09bb524789dba6913dc7e5

  • SHA256

    3e82b45c9e0c1819eea7baad7fce402472f70d23023490e364b0fb213bbbedf5

  • SHA512

    669b966a0ea1f083b12f02c1d96fe229ab12f412698d3d0d7c8c012c754cd88425302f17196a769401c20afefe894da58884e91070e2ec4973c7b405b5d923bc

  • SSDEEP

    24576:adHPXnvcC964ukjOs1iq8ZqI1IT96teRRRRRRRRRRRRRRRRRRRm7pxV2AeC+H:a9vvM4sHq9QBFM

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoverypersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2