Extracted

• • Target

    5a4b5d2da6ea58c3facadc9adf9b0eff_JaffaCakes118

  • Size

    1.9MB

  • MD5

    5a4b5d2da6ea58c3facadc9adf9b0eff

  • SHA1

    3731c810f59c1c7811a2f876ba9fe55c299af171

  • SHA256

    d9644e542d46df6aaaf06413336870607c3b6c23bf7088d98b912b96ceb644b4

  • SHA512

    5f341d959c6e0b5f2e545e186611236d774ed8b4cf64bf90706274872405f26457e2a035dff370d2d8f66396612628c0f9cfbfec3c34a0c0acb8e226d46d6f72

  • SSDEEP

    49152:53gPy3EOvdXv4sLOyGkB27eGh0qMthvTFjGygKe:5R3dVsyGYo0dfaxN

  Score

  10^/10

  lokibotcollectionevasionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2