Extracted

Extracted

• • Target

    eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118

  • Size

    2.2MB

  • MD5

    eeaa7f99337e043d590cc21b4e24eece

  • SHA1

    a517be28d8fbc2a5c4c91ef27c55bff3fa9e6baa

  • SHA256

    34f9dfcc766eaba14087b30209c5eb8856f7cbea2600f71f4e31eaab85d3db0b

  • SHA512

    66270f0fd598b38227697198cd2d33eb9fd2f07aa9e5ee8b07554d9ec4b90f6886985b5f3a1beef634efb4fd25379d161e1974a529f3dfcc79454dc4fe9a1b55

  • SSDEEP

    24576:fadJQrQVLRMYZJk9kFvk+6mADR8To1Vzh3KFHtqneNrzjzfA5a5pU9aOXUP2brPy:f3rqUK8dDjh3QN8ic4+UOb4RueGlWOBS

  Score

  10^/10

  lokibotxtremeratcollectioncredential_accessdiscoverypersistenceratspywarestealertrojan

  • Detect XtremeRAT payload

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2