Extracted

• • Target

    0b85fca069f4cde9d405fbe723b07e3b_JaffaCakes118

  • Size

    2.0MB

  • MD5

    0b85fca069f4cde9d405fbe723b07e3b

  • SHA1

    ee4102d7369a2862952695e62041322c549ba70e

  • SHA256

    ae78063adec2ca777227c34e426392c866621a57e682e875a29122431dbbfd58

  • SHA512

    2e58bc8c318476350df6b37ffd20f9fde8b09c5f1e469bef55db5495f77fca077b418eb584fc4887e98a5b9339f9110bcacd6c1ecaff1251eaeb68953627eb0b

  • SSDEEP

    49152:jJCsg2yJSp9WRYdZxJQuELv+CnaKsEJobXdAV1h1CZ6+Hwc4:jssg9JSpeYdZ0u8+CnhsaoOsDHwc4

  Score

  10^/10

  lokibotcollectionevasionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2