Extracted

• • Target

    7ea22d82741f795a1d0a48d16416485b_JaffaCakes118

  • Size

    2.0MB

  • MD5

    7ea22d82741f795a1d0a48d16416485b

  • SHA1

    98092107c7688de2c7059af5b7ab9fb31bf7c415

  • SHA256

    7e746a38ee36dc7bb2b4c8180c56cf3beaa9d7cbfc5317faf666770d8645f2c3

  • SHA512

    993cd55153aa82d257ed7829908347cce25336d87b4c971f5f63edfdb98a27b47c151fb9f97e2d6db273a428fae571b40143bf9fcdb201be36f2534757d70c65

  • SSDEEP

    49152:bYFXsb6ldp1ArkMq27XC0zwL7Tk4t4IusHO/Bv:sp5tArkMq6SMwPTk4tjXSB

  Score

  10^/10

  lokibotcollectiondiscoveryevasionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2