Extracted

• • Target

    6288dd23c69bada754051bd11bc4f9e3_JaffaCakes118

  • Size

    600KB

  • MD5

    6288dd23c69bada754051bd11bc4f9e3

  • SHA1

    ef6dbb0ce6148274d3510bb64510ba126fef2270

  • SHA256

    21090f5623e9c498291f5fea0d54bb7ea8cd27088b9a4d80b325acbf44d85b8a

  • SHA512

    a3221468afcadf4d92ee7aa4025652d03c96c081c29afc9d6a19a77d0fb4457c1cda5638e2de9eea4ef2b37d83c33b29933ec8f4b7de77daca3c85e2d9fd5e51

  • SSDEEP

    12288:xeZi970Oz6hGypNeT1tTweTJjUq2YLUAInME9qNCApAKG:gZ7p4J6aUq1LUQ4qAApAKG

  Score

  10^/10

  lokibotcollectionevasionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2