Extracted

• • Target

    a4a4727f0ccdc1e5948cc756ef4f15b8_JaffaCakes118

  • Size

    666KB

  • MD5

    a4a4727f0ccdc1e5948cc756ef4f15b8

  • SHA1

    6c536e711a2b38f5e1702176c69134969ded3fd7

  • SHA256

    3d2ab1c7a12a82acd14b3fc76c526b1970a8f026e7531809d771c7dd7600c0bd

  • SHA512

    f532f79631d0c598d48f743b11759193d4bf4154b440b354c3fc4f9b678a0e98caedfc4cde39ee7ae7048adef9084a2f044eadefb44777fb9c938cc0442eb469

  • SSDEEP

    12288:KiX22iNeHK7z2Of3MrTUD41vxwDSDmRGMe3GX8Mj1:KiG1byOfYUsHwDXRGyP

  Score

  10^/10

  lokibotcollectiondiscoveryevasionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2