Extracted

• • Target

    efe7328bfb75908ef645e3b7c0edc3d7_JaffaCakes118

  • Size

    619KB

  • MD5

    efe7328bfb75908ef645e3b7c0edc3d7

  • SHA1

    70077f140b1f6dee84c7eae8a55e3090d3ed53dd

  • SHA256

    484125e97fbe211f20a2a8d2429af67432644b68062c0f7bde8f04e2e6792ad4

  • SHA512

    293f00fe325ff1f6df83332332a29562594ab0b78a002ff8b7c3250c4dee2d2f04dfbf0e6ca5efeebf714f4594d92bc528a030cf622d85baf1eb68fef3562f76

  • SSDEEP

    12288:gMXR0z1BrYOWs0L894oBwgqTFJg9j/GbiN+ynbIXaiy:hBRzvJLkqyxi

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2