Extracted

• • Target

    ef492138cfb64e551f5511de5899efb7_JaffaCakes118

  • Size

    1.6MB

  • MD5

    ef492138cfb64e551f5511de5899efb7

  • SHA1

    1e0422bb936483191c47129ac88d7e0d43263d4e

  • SHA256

    2bb7ec39723235db02ec9df623b0b0e2dc20c85efa13587b856aef9595208d5f

  • SHA512

    8b1805fae454b098ccb1397e20787b73da2f7deaeeef35638119e68c59eb4e90c3ea4b3c00a71a5bf6d4330118e39019e625c5e889a7c86817c4153185e7f9e2

  • SSDEEP

    24576:nSmVmCJuG/VvHf/MQEHJC84XdzM5aqcZu7iGZYFMk:nSmVhpHf/M16NsqT

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoverypersistencespywarestealertrojanupx

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2