Extracted

• • Target

    1a26e405b951ad14bb16f2f8cd14924f_JaffaCakes118

  • Size

    1.0MB

  • MD5

    1a26e405b951ad14bb16f2f8cd14924f

  • SHA1

    d9d5870bba16a434f17474d70f0369793a08f6a7

  • SHA256

    a381f8f28ff9cbe526dbd0355223fdada0bd23d636b7b9e8e1c3bd5656647e41

  • SHA512

    8ebf73bb7b68890eb8f1cce41ec7dc54eae7d9f0768a3ab69f5eefcb5882aa1c7c0e580a0255166b18c52aaa0a6dfdcb77d92190a74cedc4fab6118e1130c56b

  • SSDEEP

    12288:EDb7U30YTAGVZIBwTNAHSdmv8f/Dw3ZkCzv2Z3cL776vU7sMws4sUZVi:Eg30JGVKBpMH82CHGM7n

  Score

  10^/10

  lokibotcollectiondiscoveryevasionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2