Extracted

• • Target

    075d567c223a0fc19febd6ace51b0376_JaffaCakes118

  • Size

    792KB

  • MD5

    075d567c223a0fc19febd6ace51b0376

  • SHA1

    3c8b59ea4d77f6d399d6ad88e797443b106d5c72

  • SHA256

    e7b980821a732787845f7a82c0668eba06140a5ebf32fc4c783a9c94d25a83e0

  • SHA512

    30f3a84da2b9899e6cc2e2159e486e995e55f9165d43cb0edec2e334fd3eb81fa6aae982c7483b0da2a334d91f3639c8b801c9fb29b1dca0eb8bcfed1f5ac933

  • SSDEEP

    12288:ZHFYKSn3qGaNHEyC9/oR9gy5FHK7zlhbHTjIVgBYpHnkHiLdHeA0nACLLBqRd6hg:ZHKKSPp9AR95yzTsdn1LEA0nRXBL7Cv

  Score

  10^/10

  lokibotcollectiondiscoveryevasionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2