Extracted

• • Target

    JaffaCakes118_7205f068ce8f358e659d706138779451

  • Size

    426KB

  • MD5

    7205f068ce8f358e659d706138779451

  • SHA1

    e1088006cfabba42c72507fd9ca2cec8229b2a7c

  • SHA256

    ac30eae6f453702048d8010c3ed2c83cb99bcf2ac74245de518806e1888d40fc

  • SHA512

    a95d22a6f29be34ae647980b41847095e3c4d9766d23901c4eeeada7273626f35bad4ecb1bec5214ffb3f10b31eb0721c1d20fdaef48f7286dde84617db79b6f

  • SSDEEP

    6144:bGxhLeXOIBPvYZObljKuJWjk2VZbEvARKeE:q2B9OyGuJWZVZbjKl

  Score

  10^/10

  lokibotcollectiondiscoveryevasionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2