Extracted

• • Target

    1f8eca4417277440bd6b9984b167e9e0_JaffaCakes118

  • Size

    748KB

  • MD5

    1f8eca4417277440bd6b9984b167e9e0

  • SHA1

    2c405e01e965373421cb0e697ad6c9d9446ecde6

  • SHA256

    4b01e9fc537905b7892064c0f8068e57d4412d358528a9d588c7834a4504eeb3

  • SHA512

    f654baa538f288cae4920a010c8a609aef52879c6b724604498acdf692bda8ab2fd3b83f477877ab781e850dfbcb1a193c2ea625b91a9b0aa72b4294a4179a4d

  • SSDEEP

    12288:QJREKLt0MMAugEGOULDpfrz+ekj7SGqVuXpRuh3nYaOMP43vJfD908uEeV42jerO:QJ9DugDFztkj7dqVM7aOh3vlDu8uEM4W

  Score

  10^/10

  lokibotcollectiondiscoveryevasionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2